Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528876
MD5:	f6573e376463c493395a0189bd5b6a54
SHA1:	3e297be62c83074742fb4e6515fa80e700be85de
SHA256:	1cd1a6c8b63ce8cf1ac0de34237bcbdac46f8c613536c7f1e7ad0091420def25
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5948 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F6573E376463C493395A0189BD5B6A54)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["mobbipenju.store", "bathdoomgaz.storec", "clearancek.site", "licendfilteo.sitec", "studennotediw.storec", "eaglepawnoy.storec", "dissapoiznw.storec", "spirittunek.storec"], "Build id": "4SD0y4--legendaryy"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:17.550359+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49713	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:17.550359+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49713	104.21.53.8	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:14.893324+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	55674	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:14.824632+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	52336	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:14.871467+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	49909	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:14.856619+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	54938	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:14.916624+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	51163	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:14.838524+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	50036	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:14.904220+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	58722	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T11:18:14.881616+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	61119	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware

Found malware configuration

Source: file.exe.5948.1.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["mobbipenju.store", "bathdoomgaz.storec", "clearancek.site", "licendfilteo.sitec", "studennotediw.storec", "eaglepawnoy.storec", "dissapoiznw.storec", "spirittunek.storec"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for domain / URL

Source: sergei-esenin.com	Virustotal: Detection: 11%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 13%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 13%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 13%	Perma Link
Source: clearancek.site	Virustotal: Detection: 17%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 17%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 17%	Perma Link
Source: mobbipenju.store	Virustotal: Detection: 13%	Perma Link
Source: https://sergei-esenin.com:443/api	Virustotal: Detection: 13%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49713 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00AC50FA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00A8D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00A8D110
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_00AC63B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00AC5700
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00AC99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	1_2_00AC695B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_00A8FCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	1_2_00AC6094
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00A96F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then dec ebx	1_2_00ABF030
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	1_2_00A81000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00AC4040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_00AAD1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00A942FC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00AA2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], ax	1_2_00AA2260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_00AB23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_00AB23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_00AB23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_00AB23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	1_2_00AB23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	1_2_00AB23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebp, eax	1_2_00A8A300
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	1_2_00AC64B8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00AAE40C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_00A9B410
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	1_2_00AAC470
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_00AC1440
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00A9D457
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	1_2_00A88590
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	1_2_00AC7520
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00A96536
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00AA9510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00AAE66A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00ABB650
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00AAD7AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	1_2_00AC67EF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	1_2_00AC7710
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_00AA28E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00A849A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	1_2_00AC3920
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	1_2_00A9D961
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	1_2_00A91ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	1_2_00A91A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	1_2_00AC4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	1_2_00A85A50
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00AB0B80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_00A91BEE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	1_2_00A93BE2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	1_2_00A9DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	1_2_00A9DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	1_2_00AC9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	1_2_00AAAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], ax	1_2_00AAAC91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00AC9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	1_2_00AC9CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	1_2_00AACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00AACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	1_2_00AACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	1_2_00ABFC20
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00AA7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	1_2_00AAEC48
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00AC8D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	1_2_00AADD29
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	1_2_00AAFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	1_2_00A86EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	1_2_00A96EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	1_2_00A8BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	1_2_00A91E93
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	1_2_00A90EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, ecx	1_2_00A94E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00AA7E60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00AA5E70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	1_2_00AAAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	1_2_00A96F91
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	1_2_00AC7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00AC7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [edx], 0000h	1_2_00A9FFDF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	1_2_00A88FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	1_2_00AC5FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	1_2_00AA9F62
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00ABFF70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:58722 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:54938 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:49909 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:61119 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:50036 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:51163 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:55674 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:52336 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49713 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49713 -> 104.21.53.8:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: bathdoomgaz.storec
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: licendfilteo.sitec
Source: Malware configuration extractor	URLs: studennotediw.storec
Source: Malware configuration extractor	URLs: eaglepawnoy.storec
Source: Malware configuration extractor	URLs: dissapoiznw.storec
Source: Malware configuration extractor	URLs: spirittunek.storec

Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic
Source: file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000001.00000002.2231066264.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/.
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/Z$
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000001.00000002.2231066264.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiF
Source: file.exe, 00000001.00000003.2219908926.00000000015BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000001.00000003.2219908926.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/=l
Source: file.exe, 00000001.00000002.2231066264.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/=o
Source: file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?su
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000001.00000003.2219908926.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000001.00000003.2219908926.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900J
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.6:49713 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A90228	1_2_00A90228
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00ACA0D0	1_2_00ACA0D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A92030	1_2_00A92030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065	1_2_00C60065
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A81000	1_2_00A81000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC4040	1_2_00AC4040
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A8E1A0	1_2_00A8E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CE918D	1_2_00CE918D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A871F0	1_2_00A871F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A85160	1_2_00A85160
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B3B15C	1_2_00B3B15C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A812F7	1_2_00A812F7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AB82D0	1_2_00AB82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AB12D0	1_2_00AB12D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A8B3A0	1_2_00A8B3A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A813A3	1_2_00A813A3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AB23E0	1_2_00AB23E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A8A300	1_2_00A8A300
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C56375	1_2_00C56375
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A94487	1_2_00A94487
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A9049B	1_2_00A9049B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AB64F0	1_2_00AB64F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AAC470	1_2_00AAC470
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A835B0	1_2_00A835B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BD1592	1_2_00BD1592
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A88590	1_2_00A88590
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A9C5F0	1_2_00A9C5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C54687	1_2_00C54687
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC86F0	1_2_00AC86F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C59698	1_2_00C59698
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00ABF620	1_2_00ABF620
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C5E671	1_2_00C5E671
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A8164F	1_2_00A8164F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC8652	1_2_00AC8652
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00ABE8A0	1_2_00ABE8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00ABB8C0	1_2_00ABB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AB1860	1_2_00AB1860
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A8A850	1_2_00A8A850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC89A0	1_2_00AC89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AA098B	1_2_00AA098B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC7AB0	1_2_00AC7AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC8A80	1_2_00AC8A80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC4A40	1_2_00AC4A40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A87BF0	1_2_00A87BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C51B5D	1_2_00C51B5D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A9DB6F	1_2_00A9DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C52B0A	1_2_00C52B0A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC6CBF	1_2_00AC6CBF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B55CF0	1_2_00B55CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AACCD0	1_2_00AACCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC8C02	1_2_00AC8C02
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C5BDCE	1_2_00C5BDCE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AADD29	1_2_00AADD29
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AAFD10	1_2_00AAFD10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AA8D62	1_2_00AA8D62
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A96EBF	1_2_00A96EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A8BEB0	1_2_00A8BEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A94E2A	1_2_00A94E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC8E70	1_2_00AC8E70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AAAE57	1_2_00AAAE57
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00BF6FBB	1_2_00BF6FBB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AC7FC0	1_2_00AC7FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A88FD0	1_2_00A88FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00A8AF10	1_2_00A8AF10

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A8CAA0 appears 48 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A9D300 appears 152 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9995487830033003
Source: file.exe	Static PE information: Section: zrjduasp ZLIB complexity 0.9943019572617247

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/2

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00AB8220 CoCreateInstance,

1_2_00AB8220

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: file.exe

Static file information: File size 1862144 > 1048576

Source: file.exe

Static PE information: Raw size of zrjduasp is bigger than: 0x100000 < 0x19d200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.a80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;zrjduasp:EW;mirbuaqc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;zrjduasp:EW;mirbuaqc:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c75a9 should be: 0x1d1f9b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zrjduasp
Source: file.exe	Static PE information: section name: mirbuaqc
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CF40DC push 259CFC36h; mov dword ptr [esp], edx	1_2_00CF40E4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00CF40DC push 192631FBh; mov dword ptr [esp], edx	1_2_00CF40FF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C93084 push 51C75ABBh; mov dword ptr [esp], eax	1_2_00C930A7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D5D04F push ecx; mov dword ptr [esp], 290C9100h	1_2_00D5D15B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D5D04F push ecx; mov dword ptr [esp], 73ED2AB2h	1_2_00D5D170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 126DF301h; mov dword ptr [esp], ecx	1_2_00C60073
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push ebp; mov dword ptr [esp], eax	1_2_00C60178
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 1C897A5Ch; mov dword ptr [esp], edi	1_2_00C6030A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 7909E3FCh; mov dword ptr [esp], ecx	1_2_00C60451
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 7FDE1DE9h; mov dword ptr [esp], esi	1_2_00C60550
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push edx; mov dword ptr [esp], 71F7FBBAh	1_2_00C60582
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push ebx; mov dword ptr [esp], ecx	1_2_00C6069B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push ecx; mov dword ptr [esp], ebp	1_2_00C606BD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push ebx; mov dword ptr [esp], 6FFD4B23h	1_2_00C60715
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push esi; mov dword ptr [esp], 4FBBAB48h	1_2_00C6075B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 4C418A67h; mov dword ptr [esp], edx	1_2_00C60779
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push ebp; mov dword ptr [esp], edx	1_2_00C607B4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push ebp; mov dword ptr [esp], ecx	1_2_00C60899
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 375D7A7Fh; mov dword ptr [esp], eax	1_2_00C608E4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 1A5F5500h; mov dword ptr [esp], ebx	1_2_00C6092F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push edi; mov dword ptr [esp], esp	1_2_00C609BD
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 1EB783DAh; mov dword ptr [esp], edx	1_2_00C609D5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push edx; mov dword ptr [esp], ecx	1_2_00C60A28
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push eax; mov dword ptr [esp], edx	1_2_00C60A53
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 762EFEF1h; mov dword ptr [esp], esi	1_2_00C60B0F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 571D798Fh; mov dword ptr [esp], ebx	1_2_00C60C2F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push edi; mov dword ptr [esp], eax	1_2_00C60C54
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push ebx; mov dword ptr [esp], ebp	1_2_00C60C9D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push edx; mov dword ptr [esp], ebx	1_2_00C60D7C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push edx; mov dword ptr [esp], 6DFF9726h	1_2_00C60DC4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00C60065 push 53FE468Eh; mov dword ptr [esp], edi	1_2_00C60E8A

Source: file.exe	Static PE information: section name: entropy: 7.982390407812277
Source: file.exe	Static PE information: section name: zrjduasp entropy: 7.953168337560915

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4411 second address: AE4415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE4415 second address: AE441F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FB5F8D48006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE441F second address: AE3CF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FB5F8D48AC5h 0x00000011 push dword ptr [ebp+122D0445h] 0x00000017 cld 0x00000018 call dword ptr [ebp+122D374Ch] 0x0000001e pushad 0x0000001f pushad 0x00000020 jmp 00007FB5F8D48AC4h 0x00000025 pushad 0x00000026 stc 0x00000027 jmp 00007FB5F8D48AC5h 0x0000002c popad 0x0000002d popad 0x0000002e mov dword ptr [ebp+122D1860h], edx 0x00000034 xor eax, eax 0x00000036 jmp 00007FB5F8D48AC7h 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f jmp 00007FB5F8D48AC0h 0x00000044 mov dword ptr [ebp+122D3C0Dh], eax 0x0000004a or dword ptr [ebp+122D19F9h], esi 0x00000050 mov esi, 0000003Ch 0x00000055 clc 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a mov dword ptr [ebp+122D3436h], eax 0x00000060 lodsw 0x00000062 jmp 00007FB5F8D48ABFh 0x00000067 mov dword ptr [ebp+122D1860h], ecx 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 jnp 00007FB5F8D48AB7h 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b cld 0x0000007c push eax 0x0000007d pushad 0x0000007e push eax 0x0000007f push edx 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3CF5 second address: AE3CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64A21 second address: C64A35 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB5F8D48ABAh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64D05 second address: C64D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5F8D4800Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64D16 second address: C64D1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6525E second address: C65262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65262 second address: C65270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FB5F8D48ABCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65270 second address: C65289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FB5F8D4800Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C678AB second address: AE3CF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 7C4553E5h 0x00000010 push dword ptr [ebp+122D0445h] 0x00000016 mov edx, dword ptr [ebp+122D3ACDh] 0x0000001c mov edx, ecx 0x0000001e call dword ptr [ebp+122D374Ch] 0x00000024 pushad 0x00000025 pushad 0x00000026 jmp 00007FB5F8D48AC4h 0x0000002b pushad 0x0000002c stc 0x0000002d jmp 00007FB5F8D48AC5h 0x00000032 popad 0x00000033 popad 0x00000034 mov dword ptr [ebp+122D1860h], edx 0x0000003a xor eax, eax 0x0000003c jmp 00007FB5F8D48AC7h 0x00000041 mov edx, dword ptr [esp+28h] 0x00000045 jmp 00007FB5F8D48AC0h 0x0000004a mov dword ptr [ebp+122D3C0Dh], eax 0x00000050 or dword ptr [ebp+122D19F9h], esi 0x00000056 mov esi, 0000003Ch 0x0000005b clc 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D3436h], eax 0x00000066 lodsw 0x00000068 jmp 00007FB5F8D48ABFh 0x0000006d mov dword ptr [ebp+122D1860h], ecx 0x00000073 add eax, dword ptr [esp+24h] 0x00000077 jnp 00007FB5F8D48AB7h 0x0000007d mov ebx, dword ptr [esp+24h] 0x00000081 cld 0x00000082 push eax 0x00000083 pushad 0x00000084 push eax 0x00000085 push edx 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67959 second address: C67988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 jnp 00007FB5F8D48006h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jmp 00007FB5F8D4800Bh 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67988 second address: C67992 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB5F8D48ABCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67992 second address: C679D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 sub dword ptr [ebp+122D3436h], edx 0x0000000d push 00000003h 0x0000000f mov dword ptr [ebp+122D19F9h], esi 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 mov ecx, dword ptr [ebp+122D3AF5h] 0x0000001e pop edx 0x0000001f push 00000003h 0x00000021 mov dword ptr [ebp+122D36A6h], ecx 0x00000027 jmp 00007FB5F8D4800Dh 0x0000002c push E24F249Fh 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FB5F8D4800Ah 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C679D7 second address: C67A6C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB5F8D48AB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 224F249Fh 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FB5F8D48AB8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b lea ebx, dword ptr [ebp+1245778Eh] 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007FB5F8D48AB8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b mov ecx, 45C01C8Dh 0x00000050 xchg eax, ebx 0x00000051 jg 00007FB5F8D48ACFh 0x00000057 push eax 0x00000058 jbe 00007FB5F8D48AD0h 0x0000005e pushad 0x0000005f jmp 00007FB5F8D48AC2h 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67AC6 second address: C67AE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jbe 00007FB5F8D48006h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB5F8D48010h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67AE5 second address: C67BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D5C33h], ebx 0x00000010 push 00000000h 0x00000012 adc ecx, 7D12994Dh 0x00000018 push 08F7BFF7h 0x0000001d jmp 00007FB5F8D48AC0h 0x00000022 xor dword ptr [esp], 08F7BF77h 0x00000029 mov dword ptr [ebp+122D34F5h], edi 0x0000002f push 00000003h 0x00000031 jmp 00007FB5F8D48AC3h 0x00000036 pushad 0x00000037 jng 00007FB5F8D48ABBh 0x0000003d mov eax, 54554300h 0x00000042 popad 0x00000043 push 00000000h 0x00000045 mov dword ptr [ebp+122D3693h], eax 0x0000004b push 00000003h 0x0000004d and edx, dword ptr [ebp+122D390Dh] 0x00000053 call 00007FB5F8D48AB9h 0x00000058 jmp 00007FB5F8D48AC6h 0x0000005d push eax 0x0000005e pushad 0x0000005f push eax 0x00000060 jne 00007FB5F8D48AB6h 0x00000066 pop eax 0x00000067 jmp 00007FB5F8D48AC8h 0x0000006c popad 0x0000006d mov eax, dword ptr [esp+04h] 0x00000071 jnc 00007FB5F8D48AC2h 0x00000077 mov eax, dword ptr [eax] 0x00000079 jnp 00007FB5F8D48AC4h 0x0000007f push eax 0x00000080 push edx 0x00000081 push eax 0x00000082 pop eax 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67BC7 second address: C67BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67C6C second address: C67CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FB5F8D48AB8h 0x0000000b popad 0x0000000c nop 0x0000000d call 00007FB5F8D48ABCh 0x00000012 sub dword ptr [ebp+122D3444h], ebx 0x00000018 pop edx 0x00000019 push 00000000h 0x0000001b js 00007FB5F8D48AC3h 0x00000021 call 00007FB5F8D48AB9h 0x00000026 pushad 0x00000027 push edx 0x00000028 jbe 00007FB5F8D48AB6h 0x0000002e pop edx 0x0000002f jmp 00007FB5F8D48ABFh 0x00000034 popad 0x00000035 push eax 0x00000036 jmp 00007FB5F8D48ABCh 0x0000003b mov eax, dword ptr [esp+04h] 0x0000003f jmp 00007FB5F8D48AC3h 0x00000044 mov eax, dword ptr [eax] 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push edi 0x0000004b pop edi 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67CF1 second address: C67CF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67CF7 second address: C67D1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FB5F8D48AB8h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67D1C second address: C67D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8747C second address: C87493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FB5F8D48ABEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87493 second address: C87497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50B63 second address: C50B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85266 second address: C85278 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85278 second address: C8527E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8527E second address: C85282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85282 second address: C85286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8555E second address: C85562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C856E3 second address: C856E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85892 second address: C858A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB5F8D4800Ah 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C858A7 second address: C858AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C858AD second address: C858B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85A0D second address: C85A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85CEF second address: C85CFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85CFD second address: C85D33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FB5F8D48AC8h 0x00000011 jmp 00007FB5F8D48AC2h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85EA6 second address: C85EAE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85EAE second address: C85EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85EB4 second address: C85EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D4800Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85EC5 second address: C85ED7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48ABEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85ED7 second address: C85EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85EE0 second address: C85EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48AC8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C861EE second address: C861F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C861F2 second address: C86230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48ABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007FB5F8D48AC1h 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 jmp 00007FB5F8D48AC5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7CFA1 second address: C7CFA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86C77 second address: C86CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FB5F8D48AB8h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ecx 0x00000014 push edx 0x00000015 ja 00007FB5F8D48AB6h 0x0000001b jmp 00007FB5F8D48AC7h 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87288 second address: C87293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB5F8D48006h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87293 second address: C872B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C872B4 second address: C872D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D4800Ch 0x00000009 jl 00007FB5F8D48006h 0x0000000f popad 0x00000010 push edi 0x00000011 jl 00007FB5F8D48006h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C872D4 second address: C872D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C872D9 second address: C872F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB5F8D48012h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88A83 second address: C88A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88A8A second address: C88A91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8C240 second address: C8C244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8EE36 second address: C8EE40 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB5F8D4800Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8EE40 second address: C8EE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB5F8D48ABCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C52606 second address: C5260C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5260C second address: C52629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB5F8D48AC8h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C52629 second address: C5262E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92689 second address: C9268D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9280D second address: C9281C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9281C second address: C92837 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FB5F8D48AC5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92E02 second address: C92E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92F5B second address: C92F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007FB5F8D48AC5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92F7A second address: C92F84 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB5F8D48006h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94C4E second address: C94C54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94C54 second address: C94C66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FB5F8D48006h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94C66 second address: C94C6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94CC2 second address: C94CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 xor dword ptr [esp], 5D25A757h 0x0000000c mov edi, dword ptr [ebp+122D3AE1h] 0x00000012 push 481A4485h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95285 second address: C9528B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95887 second address: C9588D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9588D second address: C95891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95B51 second address: C95B82 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB5F8D4800Ch 0x00000008 jns 00007FB5F8D48006h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jl 00007FB5F8D48025h 0x00000017 pushad 0x00000018 jmp 00007FB5F8D48017h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95D45 second address: C95D4F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB5F8D48AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95EAF second address: C95EE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FB5F8D48008h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 pop esi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95EE2 second address: C95EE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95EE6 second address: C95EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9647D second address: C96481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96DBC second address: C96DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96DC0 second address: C96DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97D0A second address: C97D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FB5F8D48008h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov esi, 51DB79B5h 0x00000028 push 00000000h 0x0000002a jmp 00007FB5F8D4800Ch 0x0000002f push 00000000h 0x00000031 add dword ptr [ebp+122D2F6Bh], edx 0x00000037 xchg eax, ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a push ecx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97D52 second address: C97D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98867 second address: C9886C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9886C second address: C9887F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FB5F8D48ABCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9887F second address: C98883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98883 second address: C9888E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FB5F8D48AB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99276 second address: C9928F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48015h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9928F second address: C99295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99295 second address: C99299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99299 second address: C9929D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99DBA second address: C99E2D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB5F8D4800Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c jmp 00007FB5F8D48017h 0x00000011 pop ecx 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007FB5F8D48008h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D17C1h], edx 0x00000033 push 00000000h 0x00000035 mov edi, dword ptr [ebp+122D3B55h] 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 push edi 0x00000042 pop edi 0x00000043 jmp 00007FB5F8D48011h 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9AA6D second address: C9AA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B580 second address: C9B5F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FB5F8D48008h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov esi, 718DC752h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FB5F8D48008h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 sub dword ptr [ebp+12457E73h], ebx 0x0000004b xchg eax, ebx 0x0000004c jno 00007FB5F8D48010h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 je 00007FB5F8D48006h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B5F4 second address: C9B5FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0B6E second address: CA0B81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D4800Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0B81 second address: CA0B93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB5F8D48ABDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2945 second address: CA294B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA294B second address: CA294F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA47DB second address: CA47DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA760F second address: CA7613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7613 second address: CA7619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7619 second address: CA761F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA761F second address: CA7623 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7623 second address: CA7664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FB5F8D48AB8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 xor bx, 5A59h 0x0000002a push 00000000h 0x0000002c mov ebx, dword ptr [ebp+122D1A38h] 0x00000032 push 00000000h 0x00000034 mov ebx, dword ptr [ebp+122D3979h] 0x0000003a push eax 0x0000003b pushad 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA84A7 second address: CA84C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D4800Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007FB5F8D48006h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA84C0 second address: CA84DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FB5F8D48AC0h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA84DE second address: CA84E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA94D1 second address: CA94D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA94D7 second address: CA94FB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB5F8D48006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB5F8D48014h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB50D second address: CAB567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D3A11h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FB5F8D48AB8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 pop edi 0x00000033 push eax 0x00000034 push edi 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FB5F8D48AC9h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC456 second address: CAC4C9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB5F8D48008h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007FB5F8D48015h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FB5F8D48008h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c sub dword ptr [ebp+124665A0h], edx 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D2A56h], edx 0x0000003a jmp 00007FB5F8D48019h 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push ecx 0x00000045 pop ecx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC4C9 second address: CAC4CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC4CD second address: CAC4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC4D3 second address: CAC4FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD43E second address: CAD4A3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FB5F8D48006h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FB5F8D48008h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push ebx 0x00000028 pushad 0x00000029 mov edi, dword ptr [ebp+122D34FDh] 0x0000002f ja 00007FB5F8D48006h 0x00000035 popad 0x00000036 pop edi 0x00000037 clc 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007FB5F8D48008h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000014h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 push 00000000h 0x00000056 mov ebx, edx 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD4A3 second address: CAD4A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF59C second address: CAF5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF5A0 second address: CAF5A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB28E3 second address: CB28EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF76E second address: CAF77C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF77C second address: CAF781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF86D second address: CAF887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48AC2h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF887 second address: CAF88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C710 second address: C5C73C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB5F8D48AB6h 0x00000008 jmp 00007FB5F8D48AC4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007FB5F8D48AB8h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C73C second address: C5C740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C740 second address: C5C744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA719 second address: CBA721 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA721 second address: CBA74A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC8h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB5F8D48ABDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA8A4 second address: CBA8A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA8A8 second address: CBA8B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FB5F8D48AB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA8B6 second address: CBA8BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC06AB second address: CC06BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FB5F8D48AB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC06BC second address: CC06D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48014h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0940 second address: AE3CF5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 22065FE3h 0x0000000f jnl 00007FB5F8D48ACCh 0x00000015 jmp 00007FB5F8D48AC6h 0x0000001a push dword ptr [ebp+122D0445h] 0x00000020 pushad 0x00000021 mov ax, bx 0x00000024 jmp 00007FB5F8D48ABFh 0x00000029 popad 0x0000002a call dword ptr [ebp+122D374Ch] 0x00000030 pushad 0x00000031 pushad 0x00000032 jmp 00007FB5F8D48AC4h 0x00000037 pushad 0x00000038 stc 0x00000039 jmp 00007FB5F8D48AC5h 0x0000003e popad 0x0000003f popad 0x00000040 mov dword ptr [ebp+122D1860h], edx 0x00000046 xor eax, eax 0x00000048 jmp 00007FB5F8D48AC7h 0x0000004d mov edx, dword ptr [esp+28h] 0x00000051 jmp 00007FB5F8D48AC0h 0x00000056 mov dword ptr [ebp+122D3C0Dh], eax 0x0000005c or dword ptr [ebp+122D19F9h], esi 0x00000062 mov esi, 0000003Ch 0x00000067 clc 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c mov dword ptr [ebp+122D3436h], eax 0x00000072 lodsw 0x00000074 jmp 00007FB5F8D48ABFh 0x00000079 mov dword ptr [ebp+122D1860h], ecx 0x0000007f add eax, dword ptr [esp+24h] 0x00000083 jnp 00007FB5F8D48AB7h 0x00000089 mov ebx, dword ptr [esp+24h] 0x0000008d cld 0x0000008e push eax 0x0000008f pushad 0x00000090 push eax 0x00000091 push edx 0x00000092 push eax 0x00000093 push edx 0x00000094 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5564 second address: CC5568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5568 second address: CC556E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC41C8 second address: CC41E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48012h 0x00000009 pushad 0x0000000a popad 0x0000000b jne 00007FB5F8D48006h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4836 second address: CC483A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4B33 second address: CC4B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4B39 second address: CC4B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4B3F second address: CC4B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4DD2 second address: CC4DEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4DEC second address: CC4E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jno 00007FB5F8D48006h 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007FB5F8D48006h 0x00000016 jg 00007FB5F8D48006h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4E08 second address: CC4E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4F7C second address: CC4FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48012h 0x00000009 jmp 00007FB5F8D4800Dh 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FB5F8D4801Eh 0x00000018 jmp 00007FB5F8D48016h 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 pushad 0x00000021 popad 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC52B8 second address: CC52CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007FB5F8D48AB6h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jng 00007FB5F8D48AB6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC95C1 second address: CC95C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC95C5 second address: CC95CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC95CB second address: CC95D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC95D5 second address: CC95D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC99F3 second address: CC9A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB5F8D48006h 0x0000000a popad 0x0000000b js 00007FB5F8D4800Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9100 second address: CC911A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FB5F8D48AB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC911A second address: CC911E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC911E second address: CC9124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9E3B second address: CC9E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9E41 second address: CC9E4D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB5F8D48AB6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9E4D second address: CC9E5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB5F8D4800Bh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE5B7 second address: CCE5D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FB5F8D48AC1h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE5D6 second address: CCE5E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5F8D4800Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEB7B second address: CCEB81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEB81 second address: CCEB87 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEE56 second address: CCEE62 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB5F8D48AB6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEFF1 second address: CCEFF7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEFF7 second address: CCF009 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF2DD second address: CCF2F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB5F8D48015h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DD96 second address: C7CFA1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FB5F8D48ABEh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FB5F8D48AB8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 jmp 00007FB5F8D48AC2h 0x0000002b call dword ptr [ebp+122D36BBh] 0x00000031 jmp 00007FB5F8D48AC7h 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push ebx 0x0000003a pop ebx 0x0000003b jmp 00007FB5F8D48AC3h 0x00000040 jg 00007FB5F8D48AB6h 0x00000046 popad 0x00000047 pushad 0x00000048 jne 00007FB5F8D48AB6h 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DFAF second address: C9DFB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FB5F8D48006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E4B9 second address: C9E4DB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB5F8D48ABCh 0x00000008 jno 00007FB5F8D48AB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB5F8D48ABEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E75B second address: C9E75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E75F second address: C9E765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E765 second address: C9E769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EE14 second address: C9EE19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F0C0 second address: C9F0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6939 second address: CD6947 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48ABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6947 second address: CD6985 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB5F8D48017h 0x00000008 jo 00007FB5F8D48006h 0x0000000e jmp 00007FB5F8D4800Bh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 jmp 00007FB5F8D48010h 0x0000001d pop eax 0x0000001e jmp 00007FB5F8D4800Fh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6D83 second address: CD6D9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6D9B second address: CD6DB2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB5F8D4800Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6DB2 second address: CD6DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FB5F8D48AC7h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD6DCE second address: CD6DD8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB5F8D48012h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD722C second address: CD7232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7232 second address: CD723E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD723E second address: CD7242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDB4E1 second address: CDB4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D4800Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD8A5 second address: CDD8AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55C06 second address: C55C0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55C0A second address: C55C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 jng 00007FB5F8D48AB6h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD35E second address: CDD362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD362 second address: CDD366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD4AF second address: CDD4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD4B8 second address: CDD4CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD4CE second address: CDD4D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD4D4 second address: CDD4F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FB5F8D48ACDh 0x0000000c jmp 00007FB5F8D48AC1h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD4F3 second address: CDD4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0338 second address: CE0359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jne 00007FB5F8D48ACCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE551C second address: CE5521 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE5521 second address: CE5533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48ABAh 0x00000009 pop edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4BE5 second address: CE4C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jne 00007FB5F8D4800Ah 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FB5F8D4800Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4EA7 second address: CE4EB5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB5F8D48AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4EB5 second address: CE4EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4EBB second address: CE4EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4EBF second address: CE4EC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4EC3 second address: CE4EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4EC9 second address: CE4ECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4ECE second address: CE4ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE51CE second address: CE51D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE51D2 second address: CE51DC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB5F8D48AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE51DC second address: CE51E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE51E8 second address: CE51EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE51EC second address: CE51F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA936 second address: CEA942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB5F8D48AB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA942 second address: CEA970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FB5F8D4801Fh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FB5F8D48006h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA970 second address: CEA974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4F049 second address: C4F065 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB5F8D48013h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4F065 second address: C4F078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ecx 0x00000008 jl 00007FB5F8D48AD2h 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9444 second address: CE9448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9997 second address: CE999E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE999E second address: CE99A8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB5F8D4800Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE99A8 second address: CE99B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE99B0 second address: CE99B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9C75 second address: CE9C79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9C79 second address: CE9C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FB5F8D4801Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE504 second address: CEE52F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB5F8D48AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB5F8D48AC3h 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 jnl 00007FB5F8D48AB6h 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE52F second address: CEE548 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jnl 00007FB5F8D4800Ch 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE548 second address: CEE556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEED3F second address: CEED45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4136 second address: CF413A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF413A second address: CF4152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB5F8D4800Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4900 second address: CF4930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB5F8D48AB6h 0x0000000a popad 0x0000000b je 00007FB5F8D48ABEh 0x00000011 pushad 0x00000012 jl 00007FB5F8D48AB6h 0x00000018 jmp 00007FB5F8D48ABEh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4C5B second address: CF4C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4C68 second address: CF4C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4C6E second address: CF4C94 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB5F8D48006h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB5F8D48018h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4C94 second address: CF4C9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4C9A second address: CF4CA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5586 second address: CF558B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF558B second address: CF5591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5591 second address: CF5595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5806 second address: CF581E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48012h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF581E second address: CF5823 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5823 second address: CF582C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF582C second address: CF5832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5832 second address: CF5836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5836 second address: CF583A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5DEF second address: CF5DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB5F8D48006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5DF9 second address: CF5DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5DFD second address: CF5E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9EDE second address: CF9EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB5F8D48AC5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA1AE second address: CFA1BE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB5F8D48006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA1BE second address: CFA1C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA1C2 second address: CFA1D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D4800Bh 0x00000007 jns 00007FB5F8D48006h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA31D second address: CFA321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00526 second address: D0053B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48011h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0053B second address: D00544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0934A second address: D09366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D4800Ch 0x00000009 popad 0x0000000a push ebx 0x0000000b jbe 00007FB5F8D48006h 0x00000011 pop ebx 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07594 second address: D075B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48ABCh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FB5F8D48AB6h 0x00000012 jp 00007FB5F8D48AB6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D075B3 second address: D075B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D075B9 second address: D075C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FB5F8D48AB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D076EB second address: D076F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D076F1 second address: D07729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB5F8D48AC6h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB5F8D48AC8h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07729 second address: D0772D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08250 second address: D08254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08254 second address: D08278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48015h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007FB5F8D48006h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D083C7 second address: D083D1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB5F8D48AB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D083D1 second address: D083DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FB5F8D4800Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D083DF second address: D0840F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007FB5F8D48ABAh 0x0000000b jbe 00007FB5F8D48AB8h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FB5F8D48AC2h 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0840F second address: D08413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08413 second address: D08417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D091C7 second address: D091CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07179 second address: D07181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FBAC second address: C5FBE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FB5F8D48017h 0x0000000a pop esi 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB5F8D48017h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FBE5 second address: C5FBE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D208B4 second address: D208BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D208BA second address: D208CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FB5F8D48AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FB5F8D48AC2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D208CE second address: D208D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D208D4 second address: D208D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D208D8 second address: D208DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D25747 second address: D25755 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB5F8D48AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D298A0 second address: D298B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB5F8D48006h 0x0000000a jnc 00007FB5F8D48006h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D315E2 second address: D31617 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FB5F8D48ABBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB5F8D48AC8h 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007FB5F8D48ABAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34729 second address: D34741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48014h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D394C3 second address: D394CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D397C2 second address: D397C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D398F6 second address: D39900 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB5F8D48AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39900 second address: D39930 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB5F8D48015h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB5F8D4800Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39930 second address: D3994D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3994D second address: D39958 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007FB5F8D48006h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39AC3 second address: D39AEE instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB5F8D48AB6h 0x00000008 jns 00007FB5F8D48AB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jng 00007FB5F8D48AB8h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB5F8D48ABEh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39AEE second address: D39AFA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39AFA second address: D39AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39AFE second address: D39B08 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB5F8D48006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39B08 second address: D39B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A801 second address: D3A83C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48015h 0x00000007 jmp 00007FB5F8D48014h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e ja 00007FB5F8D48012h 0x00000014 jg 00007FB5F8D48006h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F228 second address: D3F22C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F22C second address: D3F232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F232 second address: D3F237 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F237 second address: D3F23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3EDFF second address: D3EE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CCDD second address: D4CCE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CCE3 second address: D4CCE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F802 second address: D4F806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F806 second address: D4F80A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F80A second address: D4F81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB5F8D48006h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F81A second address: D4F820 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F820 second address: D4F83F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB5F8D48008h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB5F8D4800Bh 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F83F second address: D4F85A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB5F8D48ABEh 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jl 00007FB5F8D48AB6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50E19 second address: D50E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FB5F8D48006h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DAAC second address: D5DAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DAB0 second address: D5DAD2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB5F8D48006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FB5F8D4800Fh 0x00000010 pop ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DAD2 second address: D5DADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DADA second address: D5DAEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5F8D48010h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D953 second address: D5D96D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB5F8D48AC2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D96D second address: D5D973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D973 second address: D5D977 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D601C5 second address: D601C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D601C9 second address: D601DF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB5F8D48ABBh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D601DF second address: D601E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D601E3 second address: D60204 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007FB5F8D48AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FB5F8D48ABDh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60204 second address: D60208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78A9E second address: D78AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78AA7 second address: D78AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78AAE second address: D78AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78AB4 second address: D78ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78ABA second address: D78ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78ABE second address: D78AC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78C0F second address: D78C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5F8D48AC3h 0x00000009 pop edi 0x0000000a jmp 00007FB5F8D48AC3h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78C3D second address: D78C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D78C43 second address: D78C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79359 second address: D7935D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7935D second address: D7936F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007FB5F8D48AB6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7936F second address: D7937B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB5F8D48006h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7937B second address: D793A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB5F8D48AC7h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007FB5F8D48AB6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79696 second address: D7969C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7969C second address: D796A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DCF9 second address: D7DD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DD06 second address: D7DD0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E1F5 second address: D7E20C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5F8D48013h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E20C second address: D7E210 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E210 second address: D7E289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FB5F8D48015h 0x0000000e nop 0x0000000f jmp 00007FB5F8D4800Ch 0x00000014 mov edx, dword ptr [ebp+122D3A8Dh] 0x0000001a push dword ptr [ebp+122D2E39h] 0x00000020 or dword ptr [ebp+122D2A50h], edx 0x00000026 call 00007FB5F8D48009h 0x0000002b jo 00007FB5F8D4800Eh 0x00000031 jns 00007FB5F8D48008h 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a jmp 00007FB5F8D48019h 0x0000003f pop eax 0x00000040 jo 00007FB5F8D4800Ch 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E289 second address: D7E2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FB5F8D48AC2h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E2B2 second address: D7E2CB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB5F8D4800Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E2CB second address: D7E2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0C2E second address: 53E0C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0C34 second address: 53E0C50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, ecx 0x0000000a pushad 0x0000000b mov di, 2CA0h 0x0000000f popad 0x00000010 jns 00007FB5F8D48B19h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0C50 second address: 53E0C6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48018h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0C6C second address: 53E0C72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0C72 second address: 53E0C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0C76 second address: 53E0CC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add eax, ecx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FB5F8D48ABBh 0x00000011 and cx, 9EDEh 0x00000016 jmp 00007FB5F8D48AC9h 0x0000001b popfd 0x0000001c popad 0x0000001d mov eax, dword ptr [eax+00000860h] 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FB5F8D48ABDh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0CC2 second address: 53E0CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0CC8 second address: 53E0CFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5F8D48AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB5F8D48AC5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0CFA second address: 53E0D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5F8D4800Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0D0A second address: 53E0D0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AE3CB2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AE3D1C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C8A8BA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AE11B6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CB2920 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2740

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: file.exe, file.exe, 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000001.00000003.2219908926.00000000015BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWYF"
Source: file.exe, 00000001.00000002.2231066264.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000001.00000002.2231007768.000000000155E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0o\
Source: file.exe, 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00AC5BB0 LdrInitializeThunk,

1_2_00AC5BB0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: licendfilteo.site
Source: file.exe	String found in binary or memory: clearancek.site
Source: file.exe	String found in binary or memory: bathdoomgaz.stor
Source: file.exe	String found in binary or memory: spirittunek.stor
Source: file.exe	String found in binary or memory: dissapoiznw.stor
Source: file.exe	String found in binary or memory: studennotediw.stor
Source: file.exe	String found in binary or memory: mobbipenju.stor
Source: file.exe	String found in binary or memory: eaglepawnoy.stor

Source: file.exe, file.exe, 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: *Program Manager

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	24 Virtualization/Sandbox Evasion	OS Credential Dumping	631 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	24 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
sergei-esenin.com	11%	Virustotal	Browse
bathdoomgaz.store	14%	Virustotal	Browse
licendfilteo.site	16%	Virustotal	Browse
spirittunek.store	14%	Virustotal	Browse
dissapoiznw.store	14%	Virustotal	Browse
clearancek.site	18%	Virustotal	Browse
studennotediw.store	18%	Virustotal	Browse
eaglepawnoy.store	18%	Virustotal	Browse
mobbipenju.store	14%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://player.vimeo.com	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	0%	URL Reputation	safe
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	0%	URL Reputation	safe
https://sergei-esenin.com/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	0%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://steamcommunity.com/=l	0%	Virustotal		Browse
https://sketchfab.com	0%	Virustotal		Browse
https://www.youtube.com/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	0%	Virustotal		Browse
https://steamcommunity.com/?subsection=broadcasts	0%	Virustotal		Browse
https://sergei-esenin.com:443/api	14%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	Virustotal		Browse
https://www.google.com/recaptcha/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	Virustotal		Browse
https://steamcommunity.com/my/wishlist/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	0%	Virustotal		Browse
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Virustotal		Browse
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.254	true	false	0%, Virustotal, Browse	unknown
sergei-esenin.com	104.21.53.8	true	true	11%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	true	18%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	true	14%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	true	14%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	16%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	true	18%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	true	14%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	18%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	true	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dissapoiznw.storec	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
eaglepawnoy.storec	true		unknown
spirittunek.storec	true		unknown
studennotediw.storec	true		unknown
licendfilteo.sitec	true		unknown
clearancek.site	true		unknown
bathdoomgaz.storec	true		unknown
mobbipenju.store	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp	file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/?subsection=broadcasts	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://sergei-esenin.com/	file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://store.steampowered.com/subscriber_agreement/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.youtube.com	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/=o	file.exe, 00000001.00000002.2231066264.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/=l	file.exe, 00000001.00000003.2219908926.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://sketchfab.com	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://lv.queniujq.cn	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/?su	file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.youtube.com/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	file.exe, 00000001.00000003.2219908926.00000000015BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015BD000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/recaptcha/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://checkout.steampowered.com/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/Z$	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/;	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/about/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://steamcommunity.com/market/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/news/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/.	file.exe, 00000001.00000002.2231066264.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://steamcommunity.com/discussions/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/stats/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://medal.tv	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/apiF	file.exe, 00000001.00000002.2231066264.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/workshop/	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=qu55UpguGheU&l=e	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/	file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:27060	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900J	file.exe, 00000001.00000003.2219908926.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.steampowered.com/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219908926.0000000001596000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001596000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english	file.exe, 00000001.00000003.2219908926.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.00000000015E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2219888407.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2231066264.0000000001620000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.53.8	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528876
Start date and time:	2024-10-08 11:17:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:18:13	API Interceptor	2x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.53.8	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	lHHfXU6Y37.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8
	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	23.210.122.61
	20fUAMt5dL.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	main.bin	Get hash	malicious	Unknown	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lHHfXU6Y37.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Siparis PO# DT-TE-160924R0 _323282-_563028621286 pdf .exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://we.tl/t-BVtGtb0HLz	Get hash	malicious	Unknown	Browse	104.17.25.14
	na.elf	Get hash	malicious	Unknown	Browse	104.28.142.242
	Message_2551600.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	na.elf	Get hash	malicious	Unknown	Browse	104.16.244.186
	NXPYoHNSgv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Oilmax Systems Updated.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Oilmax Systems Updated.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	September Report 24'.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.207
AKAMAI-ASUS	na.elf	Get hash	malicious	Unknown	Browse	104.84.82.83
	Message_2551600.eml	Get hash	malicious	Unknown	Browse	2.19.126.160
	na.elf	Get hash	malicious	Unknown	Browse	23.7.233.67
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	na.elf	Get hash	malicious	Mirai	Browse	23.41.157.216
	na.elf	Get hash	malicious	Mirai	Browse	104.86.71.39
	na.elf	Get hash	malicious	Mirai	Browse	104.85.197.114
	na.elf	Get hash	malicious	Unknown	Browse	172.229.225.204
	na.elf	Get hash	malicious	Unknown	Browse	172.225.218.141
	na.elf	Get hash	malicious	Unknown	Browse	104.80.152.78

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	Oilmax Systems Updated.xls	Get hash	malicious	Unknown	Browse	104.21.53.8 104.102.49.254
	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	104.21.53.8 104.102.49.254
	Lk9rbSoFqa.exe	Get hash	malicious	SmokeLoader	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	20fUAMt5dL.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	lHHfXU6Y37.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947563861292693
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'862'144 bytes
MD5:	f6573e376463c493395a0189bd5b6a54
SHA1:	3e297be62c83074742fb4e6515fa80e700be85de
SHA256:	1cd1a6c8b63ce8cf1ac0de34237bcbdac46f8c613536c7f1e7ad0091420def25
SHA512:	5fd56a85aa33375a41e31d94df53eda6e2c343873823bab5ca410f5f45d7edb38df79278cc22e13d1bca78804924176edfdc35326f0a17ca763077f6c736bfe3
SSDEEP:	49152:/Vp2C+33W4C4mygC/Gepznh50lqny4y0://2H3A4jgwGet49
TLSH:	398533C4BBDE5DCDCCC035B426BB33CD06F15A236D8A56B13B0B6154780E325E6AD9A1
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................J...........@...........................J......u....@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB5F92FCB3Ah
cmovs ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB5F92FEB35h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	d688009f2858a1c34b56d6619b76aaa5	False	0.9995487830033003	data	7.982390407812277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x60000	0x2ab000	0x200	c8e227c519ebef18d0e42845ca1660d1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zrjduasp	0x30b000	0x19e000	0x19d200	527fcbe6f6da8e27b9305cea6b518f60	False	0.9943019572617247	OpenPGP Public Key	7.953168337560915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mirbuaqc	0x4a9000	0x1000	0x400	97714c3ad05cac05d0a73804dc6d287e	False	0.7890625	data	6.270728290961721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4aa000	0x3000	0x2200	f3fc40a42fe7eb99b753dd1cc5f26406	False	0.025160845588235295	DOS executable (COM)	0.19895209659149263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T11:18:14.824632+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	52336	1.1.1.1	53	UDP
2024-10-08T11:18:14.838524+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	50036	1.1.1.1	53	UDP
2024-10-08T11:18:14.856619+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	54938	1.1.1.1	53	UDP
2024-10-08T11:18:14.871467+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	49909	1.1.1.1	53	UDP
2024-10-08T11:18:14.881616+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	61119	1.1.1.1	53	UDP
2024-10-08T11:18:14.893324+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	55674	1.1.1.1	53	UDP
2024-10-08T11:18:14.904220+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	58722	1.1.1.1	53	UDP
2024-10-08T11:18:14.916624+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	51163	1.1.1.1	53	UDP
2024-10-08T11:18:17.550359+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49713	104.21.53.8	443	TCP
2024-10-08T11:18:17.550359+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49713	104.21.53.8	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 11:18:14.947525978 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:14.947549105 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:14.947782993 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:14.950470924 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:14.950493097 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:15.705154896 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:15.705254078 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:15.800448895 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:15.800473928 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:15.800865889 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:15.846533060 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:15.893838882 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:15.935431957 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.323435068 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.323467970 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.323503017 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.323517084 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.323518991 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.323538065 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.323549986 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.323584080 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.323606968 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.428270102 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.428344011 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.428359985 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.428375006 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.428410053 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.428433895 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.433536053 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.433607101 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.433633089 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.433681965 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.433687925 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.433794022 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.433847904 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.435978889 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.435992956 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.436011076 CEST	49711	443	192.168.2.6	104.102.49.254
Oct 8, 2024 11:18:16.436017036 CEST	443	49711	104.102.49.254	192.168.2.6
Oct 8, 2024 11:18:16.565285921 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:16.565306902 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:16.565373898 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:16.565769911 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:16.565784931 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:17.066277027 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:17.066371918 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:17.068135977 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:17.068154097 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:17.068533897 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:17.070408106 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:17.070408106 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:17.070486069 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:17.550369978 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:17.550477028 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:17.550575018 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:17.550810099 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:17.550832987 CEST	443	49713	104.21.53.8	192.168.2.6
Oct 8, 2024 11:18:17.550858974 CEST	49713	443	192.168.2.6	104.21.53.8
Oct 8, 2024 11:18:17.550863981 CEST	443	49713	104.21.53.8	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 11:18:14.824631929 CEST	52336	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.834173918 CEST	53	52336	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:14.838524103 CEST	50036	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.847332001 CEST	53	50036	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:14.856618881 CEST	54938	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.865694046 CEST	53	54938	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:14.871467113 CEST	49909	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.880131006 CEST	53	49909	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:14.881616116 CEST	61119	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.891772985 CEST	53	61119	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:14.893323898 CEST	55674	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.902930021 CEST	53	55674	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:14.904220104 CEST	58722	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.913741112 CEST	53	58722	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:14.916624069 CEST	51163	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.931922913 CEST	53	51163	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:14.936019897 CEST	60346	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:14.943624020 CEST	53	60346	1.1.1.1	192.168.2.6
Oct 8, 2024 11:18:16.439959049 CEST	61406	53	192.168.2.6	1.1.1.1
Oct 8, 2024 11:18:16.564234972 CEST	53	61406	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 11:18:14.824631929 CEST	192.168.2.6	1.1.1.1	0xdb56	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.838524103 CEST	192.168.2.6	1.1.1.1	0x9daa	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.856618881 CEST	192.168.2.6	1.1.1.1	0x7b68	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.871467113 CEST	192.168.2.6	1.1.1.1	0x7ad0	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.881616116 CEST	192.168.2.6	1.1.1.1	0x3067	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.893323898 CEST	192.168.2.6	1.1.1.1	0x7f18	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.904220104 CEST	192.168.2.6	1.1.1.1	0x8078	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.916624069 CEST	192.168.2.6	1.1.1.1	0x6140	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.936019897 CEST	192.168.2.6	1.1.1.1	0x40f1	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:16.439959049 CEST	192.168.2.6	1.1.1.1	0xc0a8	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 11:18:14.834173918 CEST	1.1.1.1	192.168.2.6	0xdb56	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.847332001 CEST	1.1.1.1	192.168.2.6	0x9daa	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.865694046 CEST	1.1.1.1	192.168.2.6	0x7b68	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.880131006 CEST	1.1.1.1	192.168.2.6	0x7ad0	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.891772985 CEST	1.1.1.1	192.168.2.6	0x3067	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.902930021 CEST	1.1.1.1	192.168.2.6	0x7f18	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.913741112 CEST	1.1.1.1	192.168.2.6	0x8078	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.931922913 CEST	1.1.1.1	192.168.2.6	0x6140	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:14.943624020 CEST	1.1.1.1	192.168.2.6	0x40f1	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:16.564234972 CEST	1.1.1.1	192.168.2.6	0xc0a8	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 8, 2024 11:18:16.564234972 CEST	1.1.1.1	192.168.2.6	0xc0a8	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	104.102.49.254	443	5948	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 09:18:15 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-08 09:18:16 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 08 Oct 2024 09:18:16 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=dd0e3a7e933c98927cc25668; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-08 09:18:16 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-08 09:18:16 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-08 09:18:16 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-08 09:18:16 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	104.21.53.8	443	5948	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 09:18:17 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-08 09:18:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-08 09:18:17 UTC	780	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 09:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=910tb38fnk86l3a32kepl239o2; expires=Sat, 01 Feb 2025 03:04:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=md5f2OvjgyZYGw0WtNf0MOxO5G%2FNvSQ3ME%2FXy2AFdTGcBplcpxKm1HR4mhgYL2FmoheNM%2FdJjcb%2Fj0Bmr%2FlhXJCWjo2Kf6ouu0OBXLumRR1PttBnCefF8q5ApATZJshwrPhH%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf50aed1c284243-EWR
2024-10-08 09:18:17 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-08 09:18:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	05:18:12
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa80000
File size:	1'862'144 bytes
MD5 hash:	F6573E376463C493395A0189BD5B6A54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	62.7%
Total number of Nodes:	51
Total number of Limit Nodes:	5

Executed Functions

Function 00AC50FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(19A41BB1,00000000,00000800), ref: 00AC5182

Strings

@^, xrefs: 00AC5120
<I$), xrefs: 00AC52E3
<I$), xrefs: 00AC5198

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: <I$)$<I$)$@^
API String ID: 1029625771-935358343
Opcode ID: 304ad092c5000a6e9e40bad75dbfea395f9a2d74d2bc4457841df944e60e5030
Instruction ID: f14e6016bcc30a11c3e00ce52972332d6d24d5184192108902d2486c4e5c6ad8
Opcode Fuzzy Hash: 304ad092c5000a6e9e40bad75dbfea395f9a2d74d2bc4457841df944e60e5030
Instruction Fuzzy Hash: 1F21A1755093848FC700DFA8D880B6AB7E4AB5A300F69482CE1C6D7351D735D955CB56

Function 00A8FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t, xrefs: 00A8FCBE
V, xrefs: 00A8FEDC
J|BJ, xrefs: 00A9000D
VY^_, xrefs: 00A8FDFF

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: d7e71158c22e05dee6f706f2552bc7684c1dd6eec3485d5c4e87bf8f48944a2a
Instruction ID: e3aafe6992af1aa19624f12ea820307cc2750853febab9e832eb9cd675da6ff1
Opcode Fuzzy Hash: d7e71158c22e05dee6f706f2552bc7684c1dd6eec3485d5c4e87bf8f48944a2a
Instruction Fuzzy Hash: 3BD1777460C3919FD710DF189590A1FBBE1AF96B84F28892CF5C98B252C336CD49DB92

Function 00A8D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00A8D2F1

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: cc93910a2f72e04d326392ffac5765f21f0a8006aeddfdf62bbf0960882afc14
Instruction ID: dbcea1ca451f19b4fc7c8e1ae4af6d0c44cafe0201bc9faf41973ab3a48704bc
Opcode Fuzzy Hash: cc93910a2f72e04d326392ffac5765f21f0a8006aeddfdf62bbf0960882afc14
Instruction Fuzzy Hash: 5141447040D380ABC701BB68D688E2EFBF5AF52744F148C1CE5C49B292D336D8148B67

Function 00AC5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00AC5784

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7fe0f4dd981670826508064ba88a70c119d6422c452b09ed208953b5461034e6
Instruction ID: e433a65d5079af2632e2e0a706f178b00b153cbdb5d00d960f20454cbde5e6e9
Opcode Fuzzy Hash: 7fe0f4dd981670826508064ba88a70c119d6422c452b09ed208953b5461034e6
Instruction Fuzzy Hash: 84118C7591D240EBC701AF28E944E1BBBF5AF96710F06882CF4859B211D335E851CB93

Function 00AC5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00AC973D,005C003F,00000006,?,?,00000018,8C8D8A8B,?,?), ref: 00AC5BDE

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00AC695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00AC69C5

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 656d23e3e59555f06d6e7c83ddd09a39d8ae91281847dc0afdc8f4bb9f17fa81
Instruction ID: 8593ba006eec75f237223259c42d83440656b9e44e01d475cf54068694dffe77
Opcode Fuzzy Hash: 656d23e3e59555f06d6e7c83ddd09a39d8ae91281847dc0afdc8f4bb9f17fa81
Instruction Fuzzy Hash: 7B318BB19183019FD718DF25C8A0B2BB7F1FF89384F58981DE5C697261E3349904CB56

Function 00A9049B Relevance: .3, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce51e96c5af0b6577e8939522d2890984b99a59f3160826fd81404282e7d535
Instruction ID: 924c45952b4dcc7fe4044d747daa28098ea3741b0a79f1be602bfdb3a5e824e5
Opcode Fuzzy Hash: 2ce51e96c5af0b6577e8939522d2890984b99a59f3160826fd81404282e7d535
Instruction Fuzzy Hash: 23917A75200B00CFD724CF65E894E16B7F6FF89710B118A6DE8568BAA1D730E816CB50

Function 00A90228 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fc5f8a449fc72fda4bd57a3a647787dfc22b45f8617201fd0dda531b1a5d50
Instruction ID: 8c5c5d86deb6a2ddbc63992a0aa7eb26d01f581902149799c415af406b28897a
Opcode Fuzzy Hash: b1fc5f8a449fc72fda4bd57a3a647787dfc22b45f8617201fd0dda531b1a5d50
Instruction Fuzzy Hash: 70717874201B00DFD724CF65E894F26BBF6FF89710F11896DE8968BA62D731A816CB50

Function 00AC99D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bbc21e44c4230c74d74fee71e50bc77b1e6cd7780f84098111d9121a61d4910
Instruction ID: 14fd28460a486de984039e30086f8342ea489ab50af4120e9b891ac4c415ed7b
Opcode Fuzzy Hash: 6bbc21e44c4230c74d74fee71e50bc77b1e6cd7780f84098111d9121a61d4910
Instruction Fuzzy Hash: A241BD34608300AFD714DB65E994F2BB7F6EB85754F26882CF58A97251D331EC02CB66

Function 00AC63B8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 52758abde5cb6a495f77bd463ad623ff49f1574eeedd60754ff22be5d2e82813
Instruction ID: 3a795b4902f74d7c3360941c066ed9709e04d2f24808d46b8e8843551860fbf1
Opcode Fuzzy Hash: 52758abde5cb6a495f77bd463ad623ff49f1574eeedd60754ff22be5d2e82813
Instruction Fuzzy Hash: 8631E470649301BBDA28DB14CE82F3AB7A5FB81B11F65891CF1826B2E1D370BC51CB56

Function 00AC3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00AC32A6

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 1efe06add1564d44efad08f715884bc90fb3553bba7a4a8e2f2ece86bc61b660
Instruction ID: 45afb24e2187e74c764e89dbf73a6ed58d058ca5673de9fabb4e10e91f50e467
Opcode Fuzzy Hash: 1efe06add1564d44efad08f715884bc90fb3553bba7a4a8e2f2ece86bc61b660
Instruction Fuzzy Hash: 70014B3550E2409BCB01EB58E949E1ABBE8EF5A700F05891CE5C58B361D235DD60CB92

Function 00AC3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00AC3208

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 010a942777577d1535ca5e44f7cd724c39ba4537e3d959a71f280a380a672531
Instruction ID: 6977bfe5015784a3a7ddbb0d3bd96f5760bc82b730dc3175fe6b7d0332646c54
Opcode Fuzzy Hash: 010a942777577d1535ca5e44f7cd724c39ba4537e3d959a71f280a380a672531
Instruction Fuzzy Hash: 5CB012300400005FDA041B40EC0AF003610EB00605F800090A101140B1D1615865C554

Non-executed Functions

Function 00AB23E0 Relevance: 33.0, APIs: 4, Strings: 13, Instructions: 3298COMMON

Download Yara Rule

Strings

fedc, xrefs: 00AB2782
#v, xrefs: 00AB344B, 00AB4861
3<, xrefs: 00AB32D6
:, xrefs: 00AB32DD
Cx, xrefs: 00AB453D
mlc@, xrefs: 00AB275C
|}&C, xrefs: 00AB2F21
aenQ, xrefs: 00AB276A
{l`~, xrefs: 00AB268C
`tii, xrefs: 00AB2693
f@~!, xrefs: 00AB25FF
%*+(, xrefs: 00AB40EF
ggxz, xrefs: 00AB2685

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+($3<$:$Cx$`tii$aenQ$f@~!$fedc$ggxz$mlc@${l`~$|}&C$#v
API String ID: 0-2260822535
Opcode ID: 1366882fe1702fd553c6c671f21206ffc3555e712830120b093fa4d009854ade
Instruction ID: 007fd5f6de5c1d71ae5004400824b1deeb5ee5eb04472c9ae684f469bb90e53e
Opcode Fuzzy Hash: 1366882fe1702fd553c6c671f21206ffc3555e712830120b093fa4d009854ade
Instruction Fuzzy Hash: 0F33AB70504B818FD7258F39C590BA2BBF5BF16304F58899DE4DA8BA93C735E806CB61

Function 00A9DB6F Relevance: 32.0, Strings: 24, Instructions: 2006COMMON

Download Yara Rule

Strings

tuJK, xrefs: 00A9E967
D, xrefs: 00A9E846
xgfe, xrefs: 00A9E71D
dcba, xrefs: 00A9E728
QNOL, xrefs: 00A9E775
DCBA, xrefs: 00A9E887, 00A9E896
T, xrefs: 00A9F157
|, xrefs: 00A9ECB1
AR, xrefs: 00A9DD10
89&', xrefs: 00A9E93B
mjkh, xrefs: 00A9E7D8
:WUE, xrefs: 00A9F6B7, 00A9F6C6
<=2, xrefs: 00A9EA01
`Y^_, xrefs: 00A9E99E
WP, xrefs: 00A9DCEF
`onm, xrefs: 00A9E733
@ONM, xrefs: 00A9E6DB
()./, xrefs: 00A9E9CA
%*+(, xrefs: 00A9DE37, 00A9DE46
lkji, xrefs: 00A9E73E
89>?, xrefs: 00A9E9F6
LKJI, xrefs: 00A9E6E6
<=:;, xrefs: 00A9E930
tsrq, xrefs: 00A9E6FC

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+($()./$89&'$89>?$:WUE$<=2$<=:;$@ONM$AR$D$DCBA$LKJI$QNOL$T$WP$`Y^_$`onm$dcba$lkji$mjkh$tsrq$tuJK$xgfe$|
API String ID: 2994545307-1418943773
Opcode ID: 094b2bbf1e2c7b3bf3c048c2047549c01dded858ecf5069a1f41c819c75125c3
Instruction ID: 398ab948ab058d6770017d522b86e76dfb9e3ecb38e11f88e84d6d163a1ae891
Opcode Fuzzy Hash: 094b2bbf1e2c7b3bf3c048c2047549c01dded858ecf5069a1f41c819c75125c3
Instruction Fuzzy Hash: B2F269B16093819FDB70CF14C484BABBBE6BFD5304F14482DE4C98B292DB359995CB92

Function 00AA9F62 Relevance: 21.7, Strings: 17, Instructions: 473COMMON

Download Yara Rule

Strings

Gt, xrefs: 00AA9FF8
=], xrefs: 00AAA36A
(a*c, xrefs: 00AAA147
]{, xrefs: 00AAA1E7, 00AAA1F3
kW, xrefs: 00AAA380
?m,o, xrefs: 00AAA13C
JG, xrefs: 00AAAA27
/), xrefs: 00AAA66D
%e6g, xrefs: 00AAA152
_Y, xrefs: 00AAA641
sm, xrefs: 00AAA830
N[, xrefs: 00AAA375
S], xrefs: 00AAA636
hi, xrefs: 00AAAB9D
CG, xrefs: 00AAAA32
WQ, xrefs: 00AAA62B
WH, xrefs: 00AAAA1C

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %e6g$(a*c$=]$?m,o$CG$Gt$JG$N[$WH$]{$hi$kW$/)$S]$WQ$_Y$sm
API String ID: 0-1131134755
Opcode ID: 4e4200e2105f13edff77c6ae28ef9b13cf5c5605724e02176b9f1a444ae8929e
Instruction ID: afe3d3baf35d8cd8b160a5e68ca9158c39f9bd2c8cd0bd77aeb44d6242ea0a24
Opcode Fuzzy Hash: 4e4200e2105f13edff77c6ae28ef9b13cf5c5605724e02176b9f1a444ae8929e
Instruction Fuzzy Hash: 0652B6B414D3858AE270CF65D681B8EBAF1BB92740F608A1DE1ED9B255DB708045CF93

Function 00AA9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

?M0K, xrefs: 00AA9968
;IJK, xrefs: 00AA983E
2A"_, xrefs: 00AA9980
!E4G, xrefs: 00AA9836
X/R), xrefs: 00AA9AEB
8;, xrefs: 00AA9B13
z=Q?, xrefs: 00AA9826
T#a-, xrefs: 00AA9AE3
B?Q9, xrefs: 00AA9B0B
B7U1, xrefs: 00AA9AFB
,A&C, xrefs: 00AA982E
pq, xrefs: 00AA99E0
G+X5, xrefs: 00AA9AF3
L3Y=, xrefs: 00AA9B03
O+f), xrefs: 00AA9634, 00AA963D
G'M!, xrefs: 00AA9ADB

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 9eb6804244f3c298cfa3c6233f9478678f9d04c30e336a82f7daf59c76fb5be3
Instruction ID: 680cd124315d2a848bbc83a2cfc773a86337f1b32b2e69b0cf24b822a3177fde
Opcode Fuzzy Hash: 9eb6804244f3c298cfa3c6233f9478678f9d04c30e336a82f7daf59c76fb5be3
Instruction Fuzzy Hash: 87F13FB4508380ABD310DF55D981A2BBBF4FB8AB44F144D1CF4D59B292D334D909CBA6

Function 00AADD29 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

{E, xrefs: 00AAE323
-M2O, xrefs: 00AAE25A
)IgK, xrefs: 00AAE261
Y9N;, xrefs: 00AAE245
%*+(, xrefs: 00AAE143
upH}, xrefs: 00AADE8A, 00AAE798, 00AADF4A
hX]N, xrefs: 00AADDC7
n\+H, xrefs: 00AADDC0
,Q?S, xrefs: 00AAE26F
<Y.[, xrefs: 00AAE27D
=]+_, xrefs: 00AAE276

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+($)IgK$,Q?S$-M2O$<Y.[$=]+_$Y9N;$hX]N$n\+H$upH}${E
API String ID: 0-1557708024
Opcode ID: ccaa7ba76e44b10f6bcbac86b71422b2ec00ba8dd35776ab30708bfc734265de
Instruction ID: c3cacbbac5ad330714f30b634e4b4e985d30f36b28226e32c65ca33f6f0da448
Opcode Fuzzy Hash: ccaa7ba76e44b10f6bcbac86b71422b2ec00ba8dd35776ab30708bfc734265de
Instruction Fuzzy Hash: F892E671E01215CFDB14CFA8D8917AEBBB2FF4A310F298169E456AB391D7359D02CB90

Function 00AA098B Relevance: 10.8, Strings: 8, Instructions: 836COMMON

Download Yara Rule

Strings

qrqp, xrefs: 00AA1089
gce/, xrefs: 00AA1073
%*+(, xrefs: 00AA0A77, 00AA0A86
&> &, xrefs: 00AA0F89
,#15, xrefs: 00AA0F94
{, xrefs: 00AA1502
cah`, xrefs: 00AA107E
9.5^, xrefs: 00AA0F9F

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+($&> &$,#15$9.5^$cah`$gce/$qrqp${
API String ID: 0-4102007303
Opcode ID: af47beb62b75d2623202b880f95cb4decf4718249410f7a706c279d9ef5627f5
Instruction ID: 46100d410f75e62d9f1b0040d3ae981f8d3595f4ce66f12791b58d1694b8b993
Opcode Fuzzy Hash: af47beb62b75d2623202b880f95cb4decf4718249410f7a706c279d9ef5627f5
Instruction Fuzzy Hash: F762A7B56083818BD730DF14D891BABBBE1FF96314F08892DE49A8B681E3359945CB53

Function 00A81000 Relevance: 10.5, Strings: 7, Instructions: 1785COMMON

Download Yara Rule

Strings

-, xrefs: 00A821ED
0123456789abcdefxp, xrefs: 00A81587, 00A815F8
0123456789ABCDEFXP, xrefs: 00A8157D, 00A815EB
@, xrefs: 00A82C40
gfff, xrefs: 00A822E1
gfff, xrefs: 00A82226
gfff, xrefs: 00A82297

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$@$gfff$gfff$gfff
API String ID: 0-2517803157
Opcode ID: a5f333585ba06b723905d7b002e6742d5c5f1720f31fb3a98eb0c7816cc08e18
Instruction ID: 57d9e7ba8ecdd6d1312671b49262c344bcb58f9fcdcd280cf026f316f0b16851
Opcode Fuzzy Hash: a5f333585ba06b723905d7b002e6742d5c5f1720f31fb3a98eb0c7816cc08e18
Instruction Fuzzy Hash: 5AD2E3726083418FD718DF29C89436ABBE2AFD5314F188A2DE499CB391D774DD46CB82

Function 00C59698 Relevance: 9.2, Strings: 6, Instructions: 1653COMMON

Download Yara Rule

Strings

YW, xrefs: 00C59CBF
/cQc, xrefs: 00C5A80A
]k^r, xrefs: 00C59E13
7ww, xrefs: 00C5A255
UN__, xrefs: 00C59837
c[mO, xrefs: 00C5A13B

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: /cQc$7ww$UN__$]k^r$c[mO$YW
API String ID: 0-874439270
Opcode ID: 702d4f24a5225b49ba6f6db20c2c254b0bc73ecc86323b1227f921bab00e7f86
Instruction ID: 2b6dfe17adaf254b613e0828d065c082ecb593a8a6469169c0987d61421878ef
Opcode Fuzzy Hash: 702d4f24a5225b49ba6f6db20c2c254b0bc73ecc86323b1227f921bab00e7f86
Instruction Fuzzy Hash: 6EB2E6F360C2049FE304AE6DEC8567AFBE9EF98720F16893DE6C4C3744E63558058696

Function 00C60065 Relevance: 7.9, Strings: 5, Instructions: 1657COMMON

Download Yara Rule

Strings

jK$, xrefs: 00C60BE8
Cf~_, xrefs: 00C60FAA
y63, xrefs: 00C60793
90o, xrefs: 00C60E8D
0y, xrefs: 00C607E0

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: jK$$0y$90o$Cf~_$y63
API String ID: 0-3734521444
Opcode ID: 87b86bb90ec45f36b573bec2f648aca6c319d70eadfa92e68bdbc7d947373b52
Instruction ID: 31823fb1d36d9936f69bdf6a89ba757877b987c89b33ff7ae1d86cf1b6c59f51
Opcode Fuzzy Hash: 87b86bb90ec45f36b573bec2f648aca6c319d70eadfa92e68bdbc7d947373b52
Instruction Fuzzy Hash: 9DB227F360C3049FE3046E2DEC8567AF7E9EF94620F1A863DEAC487744EA3558058697

Function 00A812F7 Relevance: 7.2, Strings: 5, Instructions: 922COMMON

Download Yara Rule

Strings

0, xrefs: 00A81E88
@, xrefs: 00A83531
i, xrefs: 00A828EA
0, xrefs: 00A8243E
0, xrefs: 00A81DC1

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 3dde4e92011d443bf38784757d3a23d30fd0a34c8901d3fb1e3484e0dd03908d
Instruction ID: 707be819079ef8272ef890b9932bd70e7e6ded67e111138ebfdbe863c263f1ea
Opcode Fuzzy Hash: 3dde4e92011d443bf38784757d3a23d30fd0a34c8901d3fb1e3484e0dd03908d
Instruction Fuzzy Hash: 5862D07160C3818FD718EF28C49476ABBE1AFD5304F188A2DE8DA87291D774DD49CB82

Function 00A8164F Relevance: 6.7, Strings: 5, Instructions: 472COMMON

Download Yara Rule

Strings

+, xrefs: 00A81573
gfff, xrefs: 00A81F57
gfff, xrefs: 00A81F3C
0123456789abcdefxp, xrefs: 00A81659
0123456789ABCDEFXP, xrefs: 00A8164F

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-1123320326
Opcode ID: e1937dd5de9213eaeae4ab074e16847daf674b5fc563521e35f872b3f8a3b3dc
Instruction ID: 0d56a8e2275eb65fb422bdfdd7f9a44ca4902e53cbea6a825b3bde36478c9b88
Opcode Fuzzy Hash: e1937dd5de9213eaeae4ab074e16847daf674b5fc563521e35f872b3f8a3b3dc
Instruction Fuzzy Hash: 3BF1AD3160C3818FC719DF29C48436AFBE2ABD9304F188A6EE4D987352D734D949CB92

Function 00C52B0A Relevance: 6.7, Strings: 4, Instructions: 1677COMMON

Download Yara Rule

Strings

YS, xrefs: 00C52C15
aQYK, xrefs: 00C536A8
"K|=, xrefs: 00C5355A
11s>, xrefs: 00C52CEE

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: YS$"K|=$11s>$aQYK
API String ID: 0-2011319986
Opcode ID: 16cd89a487280b070640f488acf9e9e19c674d5100f35db3a04a8891480fcc25
Instruction ID: f7bb0c9df412133056e185ff83f17f63e2a6d851636b0625a1223d7cdbf111a6
Opcode Fuzzy Hash: 16cd89a487280b070640f488acf9e9e19c674d5100f35db3a04a8891480fcc25
Instruction Fuzzy Hash: B3B2F9F360C2009FE3046E2DEC8567ABBD9EFD4720F1A463DEAC4C7744EA7598058696

Function 00A813A3 Relevance: 6.6, Strings: 5, Instructions: 390COMMON

Download Yara Rule

Strings

gfff, xrefs: 00A81F57
-, xrefs: 00A81F23
gfff, xrefs: 00A81F3C
0123456789abcdefxp, xrefs: 00A813AD
0123456789ABCDEFXP, xrefs: 00A813A3

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff
API String ID: 0-3620105454
Opcode ID: 437d959e40e8886f74d417a3a59fe70d968c79d70c9fa588dce99b03bd390789
Instruction ID: 726b81002ca65ca2376d82ce31845381b84d500c3bdbf72d1134b494b9bb5cd3
Opcode Fuzzy Hash: 437d959e40e8886f74d417a3a59fe70d968c79d70c9fa588dce99b03bd390789
Instruction Fuzzy Hash: B1D1AE7160D7818FC719DF29C48426AFBE2AFD9304F08CA6EE4D987352D634D949CB52

Function 00C56375 Relevance: 6.4, Strings: 4, Instructions: 1407COMMON

Download Yara Rule

Strings

C'_, xrefs: 00C56C90
"~], xrefs: 00C572AF
)7Nw, xrefs: 00C56B31
h., xrefs: 00C56E87

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: "~]$)7Nw$C'_$h.
API String ID: 0-343678113
Opcode ID: dad5f589689a9a74cedb574913a804c9ec099d5fed77a9cc9a4c93af5d9449ce
Instruction ID: 9e934fc965968f07956b8860468e8eb4854d2abfe0dbdbf34b93af3e99abfa5a
Opcode Fuzzy Hash: dad5f589689a9a74cedb574913a804c9ec099d5fed77a9cc9a4c93af5d9449ce
Instruction Fuzzy Hash: F9A2E9F3A0C200AFE7086E29EC8567AB7E5EF94320F1A493DEAC5C3744EA3558458757

Function 00AAFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

:, xrefs: 00AB0087
m1s3, xrefs: 00AAFEC3, 00AAFECB
uvw, xrefs: 00AAFE95
NA_I, xrefs: 00AB036D

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: dc0d6880ec58161c312c716f99148c204b37f191fe492ce0069887365910b4d8
Instruction ID: 09dde306f7346c75017296b7f9dc13de41544469ad9c06259fbb3b9913210695
Opcode Fuzzy Hash: dc0d6880ec58161c312c716f99148c204b37f191fe492ce0069887365910b4d8
Instruction Fuzzy Hash: 3A32A7B0909380DFD315DF68D880A6BBBE9AB8A340F144A2DF5D58B2A2D335D905CB52

Function 00A93BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

p, xrefs: 00A93C80
;z, xrefs: 00A93C87
ss, xrefs: 00A93C79
%*+(, xrefs: 00A93EC4

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 2dbe4b98bf3fd5d7aed23229c028b67f411093325b5a47ef2636281bda5d7824
Instruction ID: d984b7021b5b671b0f525c0bc879461da8983c5d2b56a2567af8f4fb44b7824f
Opcode Fuzzy Hash: 2dbe4b98bf3fd5d7aed23229c028b67f411093325b5a47ef2636281bda5d7824
Instruction Fuzzy Hash: D9026DB4910700DFDB60EF25D986B56BFF1FB05300F50895DE89A8B695E330A815CBA2

Function 00AA2260 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

hu, xrefs: 00AA232F
a|, xrefs: 00AA2317
lc, xrefs: 00AA2507
sj, xrefs: 00AA2327

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: a|$hu$lc$sj
API String ID: 0-3748788050
Opcode ID: a1d875891d857dd17edcd3e1fa4e508f32e8253b3de7b8932e632c0ca575696b
Instruction ID: 6fc8a056009b241e2e7013e84361a9e7a57f73a3cbe5a48c649f2ebedaf0f9f1
Opcode Fuzzy Hash: a1d875891d857dd17edcd3e1fa4e508f32e8253b3de7b8932e632c0ca575696b
Instruction Fuzzy Hash: 1AA17B748083418BC720DF18C891B2BB7F0FF96754F589A0CE8D99B291E339D955CBA6

Function 00C54687 Relevance: 5.4, Strings: 3, Instructions: 1621COMMON

Download Yara Rule

Strings

7qy, xrefs: 00C54A48
qw, xrefs: 00C55715
|j{, xrefs: 00C5558B

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: 7qy$|j{$qw
API String ID: 0-1122578392
Opcode ID: 7fb2c5dc86cb70558534359d16c1d17bfc7683391ad2237f848a91bc92e50291
Instruction ID: 9c9f353b464fa036efc34a038c19c3953196e813eff78eec8ab397bbe286294c
Opcode Fuzzy Hash: 7fb2c5dc86cb70558534359d16c1d17bfc7683391ad2237f848a91bc92e50291
Instruction Fuzzy Hash: E7B218F360C210AFE3146E2DEC8567ABBE9EF98760F1A453DEAC4C7744E63558008796

Function 00AAD7AF Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

T>, xrefs: 00AAD984
#', xrefs: 00AAD9EA
CV, xrefs: 00AAD98B
KV, xrefs: 00AAD97D

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: #'$CV$KV$T>
API String ID: 0-95592268
Opcode ID: 0dc11a9f9ea3347781497e5f0d28395ef2d4d28a776d5d3d9fbd2b637fcc32ce
Instruction ID: f622b162fbaab3dd923ee8ca649b7790b3fac089a6f5653bac742b246a224f71
Opcode Fuzzy Hash: 0dc11a9f9ea3347781497e5f0d28395ef2d4d28a776d5d3d9fbd2b637fcc32ce
Instruction Fuzzy Hash: 9D8155B48017459BDB20DFA5D2855AFBFB1FF16300F60460CE486ABA95C334AA55CFE2

Function 00AAAC91 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

4c2a, xrefs: 00AAACA9
lk, xrefs: 00AAACBC
(g6e, xrefs: 00AAACA1
,{*y, xrefs: 00AAAD07, 00AAAD13

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: (g6e$,{*y$4c2a$lk
API String ID: 0-1327526056
Opcode ID: cf62c8f68b1da61546436fbc0b21b49328ead47780ee929465d8dcd7a9ea2b1c
Instruction ID: 5d07252c0dd3d0060b975b401effb21bc470a748ab11958fa81348e3e917c321
Opcode Fuzzy Hash: cf62c8f68b1da61546436fbc0b21b49328ead47780ee929465d8dcd7a9ea2b1c
Instruction Fuzzy Hash: 8D4182B4409382CBD7209F20D900BABB7F0FF86305F54995EE5C997260EB32D945CB96

Function 00AAC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AAC8C3, 00AAC8CB
~/i!, xrefs: 00AAC537
%*+(, xrefs: 00AAC9E4, 00AAC9ED

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: d5c95260221309cd0f4e5de3b7a581e4ed7c0223d4677ac8edd48f5972fff2c7
Instruction ID: a3a3a536ac10b1c8779c9ba6056c6a3595e1c2f6297bc9fa7d2018efcd796d7f
Opcode Fuzzy Hash: d5c95260221309cd0f4e5de3b7a581e4ed7c0223d4677ac8edd48f5972fff2c7
Instruction Fuzzy Hash: 53E198B5909340EFE320DFA4D881B2BBBF5FB86354F44882DE58987291E735D811CB92

Function 00A88590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 00A88616
), xrefs: 00A8860C
IEND, xrefs: 00A889F0

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 7f76533d75984917e50c36cd762360c0b8ccbc1822cc904b518f249e35248c61
Instruction ID: a7d46939ead9f0dd7b7c44dce03da017d3364dcecf8120ae0902857e1f756e95
Opcode Fuzzy Hash: 7f76533d75984917e50c36cd762360c0b8ccbc1822cc904b518f249e35248c61
Instruction Fuzzy Hash: 5AE1E1B1A087029FE310EF28D88172AFBE1BF94314F54492DE59597381EB79E914CBD2

Function 00C5E671 Relevance: 4.1, Strings: 2, Instructions: 1571COMMON

Download Yara Rule

Strings

2y~{, xrefs: 00C5F323
$Uu, xrefs: 00C5F343

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: $Uu$2y~{
API String ID: 0-674208736
Opcode ID: 8348fdf11ca2443546b9cd32bcd3b5052cdeea2300d23312f03bccbd3e12035b
Instruction ID: 02c2dde833218ec7022eb2f70ce492c249cfaf66a4b16181c6b50aba0a78d62a
Opcode Fuzzy Hash: 8348fdf11ca2443546b9cd32bcd3b5052cdeea2300d23312f03bccbd3e12035b
Instruction Fuzzy Hash: D4B206F360C2049FE3046F29EC85A7ABBE9EF94720F16493DEAC4C3744EA3559058697

Function 00AC4040 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC40A4, 00AC40AD
f, xrefs: 00AC420C

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+($f
API String ID: 0-2038831151
Opcode ID: 7e454c422a1fe5460fb2b3eb7f5df30e35f98fb4342b8501244589d33270b6e2
Instruction ID: 99de6d7f8bc0f25b369e05642a56c35359e9abbd5542525404fcc91fbdcd30fe
Opcode Fuzzy Hash: 7e454c422a1fe5460fb2b3eb7f5df30e35f98fb4342b8501244589d33270b6e2
Instruction Fuzzy Hash: 1B129B716083419FC714CF28C8A0F2ABBF2BB89314F198A2DF4D59B291D735E945CB96

Function 00ABF620 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

dg, xrefs: 00ABF7F5
hi, xrefs: 00ABF6E6

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: dg$hi
API String ID: 0-2859417413
Opcode ID: 9ea837ab31a0cc20b6debd071fa3cb882bb6ae4587564c3eb09ff377118df0ab
Instruction ID: a231bfcfe6626723e05fdf76f6f682318f394432ca578798051118d0548bb395
Opcode Fuzzy Hash: 9ea837ab31a0cc20b6debd071fa3cb882bb6ae4587564c3eb09ff377118df0ab
Instruction Fuzzy Hash: E1F19471618341EFE704CF64D891B6ABBF6EB89344F189D2DF0868B2A2C735D845CB12

Function 00A835B0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

NaN, xrefs: 00A8360E
Inf, xrefs: 00A83607

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: Inf$NaN
API String ID: 0-3500518849
Opcode ID: a96352e4fa258c05b91129135dd48cdfb5b711b8ad19d79e4506251617c4f63a
Instruction ID: 035c3b5eecd6856fb89326065b0c7ca4b1b5e5d2b9ddb2885b4bfb528115d14e
Opcode Fuzzy Hash: a96352e4fa258c05b91129135dd48cdfb5b711b8ad19d79e4506251617c4f63a
Instruction Fuzzy Hash: C7D1D672A083119BCB08DF29C88061EFBE5EBC8B50F15893DF99997390E675DD058B82

Function 00A9FFDF Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BaBc, xrefs: 00AA0197
Ye[g, xrefs: 00AA00F6

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: BaBc$Ye[g
API String ID: 0-286865133
Opcode ID: 5c495a3398408b88a4d899f13cb63bb0a19c9df299c5bec98e97b25b5b8b88fb
Instruction ID: 0584e985dfa1609002c117b4f63a6133b81a54848347b1b1202dc3b881917718
Opcode Fuzzy Hash: 5c495a3398408b88a4d899f13cb63bb0a19c9df299c5bec98e97b25b5b8b88fb
Instruction Fuzzy Hash: 375189B16083818BD731DF18C881BABB7E0FF97360F19492DE49A8B691E3749944CB57

Function 00C5BDCE Relevance: 1.9, Strings: 1, Instructions: 602COMMON

Download Yara Rule

Strings

;$wg, xrefs: 00C5C221

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: ;$wg
API String ID: 0-2323797322
Opcode ID: 1181b87e101e84e33dbb0f4509666f230e80abb7417a955e95bfe4270ab44fe7
Instruction ID: dbe660cc68888cc8046424abebe31c78700c48a7a341240addf6c6e1fd386e4c
Opcode Fuzzy Hash: 1181b87e101e84e33dbb0f4509666f230e80abb7417a955e95bfe4270ab44fe7
Instruction Fuzzy Hash: A41204F360C6049FD3046F2DEC8567AFBE9EFD4720F16492EE6C487350EA3558418A56

Function 00A85160 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

%1.17g, xrefs: 00A854C8

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %1.17g
API String ID: 0-1551345525
Opcode ID: c15d4aebe056cedfa328704b1a229789e3290a630df9baf01febe66908791450
Instruction ID: 06505d7787c404500f073ca89a8f2ad20194811dc16090b79a19900ecf84454f
Opcode Fuzzy Hash: c15d4aebe056cedfa328704b1a229789e3290a630df9baf01febe66908791450
Instruction Fuzzy Hash: 7122BFB6E08B428BE715AF38D940326BBA2AFA1314F1DC96DDC994B341E771DC49C742

Function 00AB12D0 Relevance: 1.7, Strings: 1, Instructions: 484COMMON

Download Yara Rule

Strings

", xrefs: 00AB15D1

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction ID: a352eb43eeebf1d4b7aafd0fee418c9b3e2cd05a9624db4f0244fd287cea9cff
Opcode Fuzzy Hash: 1e36e4a90a5bcd9904d9a2755a98640d2f51fe7f53356f7c076c40d918f289ea
Instruction Fuzzy Hash: AEF10871A083415FC724CF24C4A06ABBBEAAFC5354F58C96DE89A8B383D634DD45C792

Function 00AAAE57 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AAB2D3, 00AAB2DB

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 6c62b46fa64565a35d153d6518b3b9e27f00d6bc43e39c9fcde1ad0f045a5818
Instruction ID: a8cae4ae026cb0339563bcf0b8087b166c3ca59352ae5ad7cbe95eb9dcf5d24e
Opcode Fuzzy Hash: 6c62b46fa64565a35d153d6518b3b9e27f00d6bc43e39c9fcde1ad0f045a5818
Instruction Fuzzy Hash: F9E1DC71518306DBC714EF28C49056EB3F2FF9A781F54891CE4C6872A1E331E959CBA2

Function 00A96EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00A96EF3

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5f6eb54b63cfb12d93f21fb623076c6f19f3f7c8c88d37579fd8bccfe7a961e6
Instruction ID: 4d72f253ebe55585c1f24fa83924ede525e66a2e65fa6afe7a258a477d4d526c
Opcode Fuzzy Hash: 5f6eb54b63cfb12d93f21fb623076c6f19f3f7c8c88d37579fd8bccfe7a961e6
Instruction Fuzzy Hash: 3EF18DB5A00B01CFCB24DF24D981A26B3F6FF48314B158A2DE49787AA1EB34F815CB51

Function 00AA7E60 Relevance: 1.7, Strings: 1, Instructions: 425COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AA8263, 00AA826B

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 4f1bb1de5700747ddf132b937094556c2a52e81096cfc3e9d69edc574bd1c648
Instruction ID: f511251f0cad7b9f9d6dd53100707a088f1c5ae4d54f3a44ddddf02f426856f3
Opcode Fuzzy Hash: 4f1bb1de5700747ddf132b937094556c2a52e81096cfc3e9d69edc574bd1c648
Instruction Fuzzy Hash: 3BC19E71908200ABD711EB14CD82A2FB7F5EF96754F08891CF8C59B291E739ED15CBA2

Function 00AA8D62 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AA9233, 00AA923B

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: b7a037cc21b4f89b60e7250bdbdee9abe4042c4bea9602e5073cf7a7f978c264
Instruction ID: 4b8377a4a4eb2153d39ba7aa61a48ba74ff0c32d3923e0f64ff2ec67dfad5a89
Opcode Fuzzy Hash: b7a037cc21b4f89b60e7250bdbdee9abe4042c4bea9602e5073cf7a7f978c264
Instruction Fuzzy Hash: 70D1CD70619302DFD704DFA8DC90B2AB7E6FF8A304F59886EE88687291D734E951CB51

Function 00AC7FC0 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

P, xrefs: 00AC8167

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: a85ffea7b153fbe731cf85d391b581100bce74389cd7213e4447ca86ec539fdb
Instruction ID: b8bfef908bcc260d4f5cfcc89f974939cf1c7433e7c3371ba6dab19a39538b49
Opcode Fuzzy Hash: a85ffea7b153fbe731cf85d391b581100bce74389cd7213e4447ca86ec539fdb
Instruction Fuzzy Hash: 31D1D4729082658FC725CE189890B5EB7E1FB85718F168A3CE8B5AB380DB75DC46C7C1

Function 00AACCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AACDC3, 00AACDCB

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: bc27126c810948894e5bea5723c60ef94d02f255bfc00b6f5c26ce43913b711e
Instruction ID: 5dcedefb80cc9d19d32693c706a643fcea6115fa92c2d22720a730140046b9aa
Opcode Fuzzy Hash: bc27126c810948894e5bea5723c60ef94d02f255bfc00b6f5c26ce43913b711e
Instruction Fuzzy Hash: 97B1D070A093019FE714DF64D880B2BBBE2EF96360F14492CE5C68B291E335D955CB92

Function 00A8A850 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 00A8A9C3

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction ID: a17c4fa5bc1354185ce3f2a7f4cab73b3c8458d4fba7d9b04bd0d14d20238a06
Opcode Fuzzy Hash: 6a3fef2072c4110c7e08f213014c8aa891b97c95317c3c670d38149bab24221c
Instruction Fuzzy Hash: 3AB1287120C3819FD324DF28C88461BBBE1AFA9704F448A2DF5D997342D675EA18CB67

Function 00ABFC20 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00ABFCA4, 00ABFCAD

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: c0e285fb782897f3e9dbcab52d2397cf6bd00d06e2e702c14c3158e721afd446
Instruction ID: 2fd74f4d1541d27c5be303a90f0c6c65266c338f9429d32a74c5b2e1cd1957ac
Opcode Fuzzy Hash: c0e285fb782897f3e9dbcab52d2397cf6bd00d06e2e702c14c3158e721afd446
Instruction Fuzzy Hash: 7981BC71609300AFD710DFA8DD84B6AB7E9FB99705F188C2DF18587252E731E815CB62

Function 00A9D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00A9D663, 00A9D66B

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: e59c358b230bc13f90feb496a8d5fe8edd290331296a9e719808be9ca5f989d0
Instruction ID: 6a469c55c2ba6d0ff12d5dbed53e68fb1db43a432c715deaaff218c335fe7257
Opcode Fuzzy Hash: e59c358b230bc13f90feb496a8d5fe8edd290331296a9e719808be9ca5f989d0
Instruction Fuzzy Hash: 1861F271A09204DBDB10EF58DC82A2AB3F1FF95354F09092DF98A8B251E335E951CB92

Function 00AC4A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC4C33, 00AC4C3B

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: bcd9fd1c3192ff6009bbcf7516149c63d0a52be9a8ccbc5c0463b5bcdfba5f6f
Instruction ID: d3ee69862c3ffdacc61faf150e5e33f422105089ba9972d22d291c0f4ed0ff0f
Opcode Fuzzy Hash: bcd9fd1c3192ff6009bbcf7516149c63d0a52be9a8ccbc5c0463b5bcdfba5f6f
Instruction Fuzzy Hash: F061E371A0D3019BD710DF65C8A0F2ABBE6EBC8314F2A891CE9C5872A1D731EC41CB59

Function 00BD1592 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

r7", xrefs: 00BD1845

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: r7"
API String ID: 0-2864999764
Opcode ID: 0aa5323ab607a90670508baaaaa354a875342f7e84b39eb4c5d5cce4c1982414
Instruction ID: 0858cd946e3c65b69bc6f950f1c40246f96a07ba44cef7ea5d17cfba63561230
Opcode Fuzzy Hash: 0aa5323ab607a90670508baaaaa354a875342f7e84b39eb4c5d5cce4c1982414
Instruction Fuzzy Hash: EB6114B3E186149FF744AA28EC853B6B7E5EB54320F1A493DEAC4C73C4E5399C058686

Function 00A8E1A0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00A8E333

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: 1d752078703a717ca83913722db2b260e3a407754b0bfb425b194b18759f7ed8
Instruction ID: dcefb9db7f3889e7e6852e4c2e0f534e9a54842c6485f2b2fe75d2437114b69d
Opcode Fuzzy Hash: 1d752078703a717ca83913722db2b260e3a407754b0bfb425b194b18759f7ed8
Instruction Fuzzy Hash: 93513737B196A08BD328EA7C4C552AA7AD74BE2334B3EC369E9F5CB3E1E5154C014390

Function 00AC3920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC39E3, 00AC39EB

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5c53358d83e7103453b1908cd0bc450fa546a332cf7ff6838818abb07cb65901
Instruction ID: b5377cc021cb1ddab5ef78fc946481d3850cd7255a970d0823b156523f682340
Opcode Fuzzy Hash: 5c53358d83e7103453b1908cd0bc450fa546a332cf7ff6838818abb07cb65901
Instruction Fuzzy Hash: F0517D326092409BCB24DF55D990F2EBBE5FB89784F15C81CE4C697251D772ED20CB62

Function 00BF6FBB Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

fJ*, xrefs: 00BF7043

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: fJ*
API String ID: 0-2622570556
Opcode ID: ffb86bffa760865227139b71eecbebcdbf78f61d39952b3da6c9e5809ee2ebad
Instruction ID: aa79e994bf91312ab6834a9ec696e41eeae0de3a9f8fbdfe7d2fed934dc1bc6b
Opcode Fuzzy Hash: ffb86bffa760865227139b71eecbebcdbf78f61d39952b3da6c9e5809ee2ebad
Instruction Fuzzy Hash: B94138F7E082145BF304AA2ADC4436BB696EBC0720F16C43D9B88A77D8E93D4C0646D9

Function 00A91BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00A91C3E

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: 9f2dc8b4ff353c613c8588427874f7d60bc5d1d164eff2734099b5c42a83d269
Instruction ID: c97073e1a451ad018ede3dd43307e555ad0ff3085e63e318494398247b001b89
Opcode Fuzzy Hash: 9f2dc8b4ff353c613c8588427874f7d60bc5d1d164eff2734099b5c42a83d269
Instruction Fuzzy Hash: 424173B81083819BCB149F69D894A2FBBF0FF8A314F048A1CF5C69B290D736C915CB56

Function 00ABFF70 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00AC0033, 00AC003B

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: a4f80f5d648850dc8fda2ff4864ed4dd985a3a87662df91a1cdea41cd024c295
Instruction ID: fcdcb1b2831bebdb631eb065ea6c4f20aa81705cd39b5b4a05fba4d7e523d2bf
Opcode Fuzzy Hash: a4f80f5d648850dc8fda2ff4864ed4dd985a3a87662df91a1cdea41cd024c295
Instruction Fuzzy Hash: AB31C3B5A08305EBD610EB68DD81F2BB7E9EB85748F56482CF88597252E231DC14C7A3

Function 00AAE40C Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

72?1, xrefs: 00AAE6A2

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: fb5e5e27a538ebdc02e72e5b7e3f18df011655d716da1dea3b489c2ddd066f2c
Instruction ID: 9298994074dce02e5512b6660fc3b30b86be3f67fb2536da5b772fbf660085d3
Opcode Fuzzy Hash: fb5e5e27a538ebdc02e72e5b7e3f18df011655d716da1dea3b489c2ddd066f2c
Instruction Fuzzy Hash: 8D31E1B5A01204DFCB20DFD5E9905AFFBB5FB0A744F540829E446AB341D335AE05CBA2

Function 00A96F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00A9703B

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 68a3834734941833674cb92b569bd48742b845a2dce2ac64f7e3a090e681a346
Instruction ID: a6f425306f034b14add9adb198e2af4c5756157e903a67891175f4855c244023
Opcode Fuzzy Hash: 68a3834734941833674cb92b569bd48742b845a2dce2ac64f7e3a090e681a346
Instruction Fuzzy Hash: DD413575615B04DBDB25CB61DA94F2AB7F2FB09701F24891DE5869BAA1E331F8008B20

Function 00AAE66A Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

72?1, xrefs: 00AAE6A2

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID: 72?1
API String ID: 0-1649870076
Opcode ID: 4c6a07477ac5444d05aa5a6f8f26895d05b4f8a289d8603f2bdfc73fec4cddb8
Instruction ID: 49c885388e60c51a0c2648ea0a30d0d1d3b3d81d8e5b3e202309979f631fe584
Opcode Fuzzy Hash: 4c6a07477ac5444d05aa5a6f8f26895d05b4f8a289d8603f2bdfc73fec4cddb8
Instruction Fuzzy Hash: D021AEB1A01204DFC720DF95E9A0A6FBBB5BB1A744F54081DE446AB381C335AD41CBA2

Function 00AC9CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00AC9D30

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 955adea7583ddf3388bbe42218463338320b52a5474b584e89d7359c1a48db27
Instruction ID: bcbcdc8c1beb629b527fb4f34ff57e902f10439e834c858a61b3b9566a326f22
Opcode Fuzzy Hash: 955adea7583ddf3388bbe42218463338320b52a5474b584e89d7359c1a48db27
Instruction Fuzzy Hash: 443186709093008BD310DF24D884A2BFBF9EF9A314F25892CE1C6A7251D335D904CBA6

Function 00A94E2A Relevance: 1.0, Instructions: 957COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c522c1cfbdcc5278d9a7a3b356a8e80f3ff682eff2906c2b017094bf5e657e44
Instruction ID: 4241c55816b2229e5aa0d47a74c96c1622306f7a6793ee47b7e7228a6932968a
Opcode Fuzzy Hash: c522c1cfbdcc5278d9a7a3b356a8e80f3ff682eff2906c2b017094bf5e657e44
Instruction Fuzzy Hash: 9B6259B0A00B009FDB26DF25D991B27B7F6AF49714F54892CD49B8BA52E734F804CB91

Function 00A8BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction ID: 344e0c2991675fa94084dda9327e88b561ee8cd48cdca4c8350fbbe1b54f57ed
Opcode Fuzzy Hash: 30cb9a533554be97e06675d3460cdff0be9d55b2c6c1132c24f0b6137cc6b4a7
Instruction Fuzzy Hash: C1521B319087118BC725AF18E4442BAF3E1FFD5329F258A3DD9C697281E734A851CF96

Function 00AC8652 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3da84669004d588cf3eb5dfdc856a10b06308ce25337dc206786e249161af18
Instruction ID: b81e34a21d4477963ebc55e7998ef6084ca2d01ecea57288cef84a015ef17c3a
Opcode Fuzzy Hash: d3da84669004d588cf3eb5dfdc856a10b06308ce25337dc206786e249161af18
Instruction Fuzzy Hash: 9F22AB35609341CFC704DFA8E890A2AB7F1FB89315F0A896EE5CA87351D735D951CB42

Function 00C51B5D Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3c345d78fe5c8fe45bc4e060cf668b1e313f38eec324c40e3702c7676fc0f9
Instruction ID: efe4ef72e04942da1fc92267312e76b6bc7d56a70f1615a9cc40fec91e6ac027
Opcode Fuzzy Hash: 0d3c345d78fe5c8fe45bc4e060cf668b1e313f38eec324c40e3702c7676fc0f9
Instruction Fuzzy Hash: 702218F360C214AFE3046E6DEC8577ABBE9EB94320F1A463DE6C4C3744EA7558018697

Function 00AC86F0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9810de83b342be5fd15c30db4781fd85a8a6b4884c0a87ce96d05f9b3c5913cd
Instruction ID: 6c68adab705cf13255d6c66f053d92661fdd40ce37f4084503708e958f87c5bf
Opcode Fuzzy Hash: 9810de83b342be5fd15c30db4781fd85a8a6b4884c0a87ce96d05f9b3c5913cd
Instruction Fuzzy Hash: F9229A35609341DFD704DFA8E890A2ABBF1FB8A305F0A896EE5CA87351D735D851CB42

Function 00A8B3A0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82344ce6d1b6acdd9eec3a7b7dea349cb5bc6fd7c4056a342599c20b951fdfdc
Instruction ID: e066f1cb7e3cfe0ab1f2dd359fcfd1ce84cc8a8c238576a7620f1218afb892aa
Opcode Fuzzy Hash: 82344ce6d1b6acdd9eec3a7b7dea349cb5bc6fd7c4056a342599c20b951fdfdc
Instruction Fuzzy Hash: AB52E7B0918B848FE735EB24C4943A7BBE2EF95314F144C2DC5E706B82C779A885C761

Function 00A871F0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458a69e1a144b4686bba4e958d890665586b0aa45550bb21e5f386d3b401ddf9
Instruction ID: c604523fbb82d9f7d5cbf4a93ac98289f1f0953771a59486d214a892b95a82c2
Opcode Fuzzy Hash: 458a69e1a144b4686bba4e958d890665586b0aa45550bb21e5f386d3b401ddf9
Instruction Fuzzy Hash: F552B03150C3458FCB19DF29C0806AEBBE1BF89314F298A6DE89A5B351D774D989CB81

Function 00A88FD0 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbcf424f39e98244bbd7342b0c1ead0221f112422fd8c5fddf0e77f63c0b7bdc
Instruction ID: dd08a77e2b97936b09b02dfbf8ae7ae9ff4ac1fd03c6c19160c4378a9c76321f
Opcode Fuzzy Hash: bbcf424f39e98244bbd7342b0c1ead0221f112422fd8c5fddf0e77f63c0b7bdc
Instruction Fuzzy Hash: 82425775608341DFD708CF68D950B6ABBE1BF88315F0A886DE4858B391D736D986CF42

Function 00A87BF0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4575a97548d6bf0269f3eeffe68a861e45cad504ca40986d52556cba99a4f22
Instruction ID: b94281497752bc2d118054cdf24e6c723a7126e5c416ce454b5440c9ec243fcd
Opcode Fuzzy Hash: b4575a97548d6bf0269f3eeffe68a861e45cad504ca40986d52556cba99a4f22
Instruction Fuzzy Hash: 06320270514B118FC368EF29C59056ABBF2BF55710BA04A2ED6A787F90DB36F845CB10

Function 00AC89A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e9e7546b565daceca438ab2433fc479cf8a65cb9b453cc7731c8296c6c1914
Instruction ID: 03b54ab63a08ab9a90f9c8e2749417eec20e8ec9993d5e67232d64181894860c
Opcode Fuzzy Hash: b7e9e7546b565daceca438ab2433fc479cf8a65cb9b453cc7731c8296c6c1914
Instruction Fuzzy Hash: F5029A35609341DFC704DFA8E880A1AFBF5FB8A305F0A896EE5C687261C735D951CB92

Function 00AC8A80 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e39bd10b4d88de57d53a67b853a3a88213e78784153146c9b9a0e1497bc9593
Instruction ID: d6f05a00d9e4ff0ef89f9d51b5086483f88575ccd2b24c1c2540326808bfa6be
Opcode Fuzzy Hash: 9e39bd10b4d88de57d53a67b853a3a88213e78784153146c9b9a0e1497bc9593
Instruction Fuzzy Hash: 9AF1793560D340DFC705DF68E880A2AFBF5AB8A305F09896DE4DA87251D736D911CB92

Function 00AC8C02 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8e85e267b3106efa98d8e376ee3423fe74f90e1fd19003f505d0752320afa5
Instruction ID: 9a1fd9418ccacd995205fe2155df708768a351c6e30f7426fd5bb08c201735ee
Opcode Fuzzy Hash: 9b8e85e267b3106efa98d8e376ee3423fe74f90e1fd19003f505d0752320afa5
Instruction Fuzzy Hash: F0E1AD35609340CFC704DF68E880A6AF7F5BB8A315F0A896DE4DA87351D736D911CB92

Function 00A8A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction ID: 5d1ee018c7c9d7bbf26fe06f7472bb91ae2c6a4c1d73533df5105cfd6db38e2c
Opcode Fuzzy Hash: 8dbf8a9190905fd82ba4d34b3568b61c3c587483ba5650872ac470c2db95d517
Instruction Fuzzy Hash: BFF1AF756087418FD724DF29C88166BFBE6BFE8300F08882DE4D587751E639E945CB62

Function 00AC8E70 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413ed94244410d0256e6d8b549b2a54f250fc84e529796b3b761c24c5063b905
Instruction ID: acfda72b4e71f854546bc06875e4e11deeb7db2d93a43b1cefe854042e38d416
Opcode Fuzzy Hash: 413ed94244410d0256e6d8b549b2a54f250fc84e529796b3b761c24c5063b905
Instruction Fuzzy Hash: 79D1993460D280DFD705EF68D884A2AFBF5EB8A305F0A896DE4C687251D736D811CB92

Function 00A94487 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f584872d1bd5cc1e3fd2b9fba5ca9f44328f91c5a570ef0aba0d3aa37713fd54
Instruction ID: 271d072c611d846f63ad9c47eea8a71c7a145f2fbce0dfc0d8b3d5d2fe223eca
Opcode Fuzzy Hash: f584872d1bd5cc1e3fd2b9fba5ca9f44328f91c5a570ef0aba0d3aa37713fd54
Instruction Fuzzy Hash: B4E10FB5601B008FD725CF28D992B97B7E1FF0A708F04886DE4AACB752E735B8158B54

Function 00AC6CBF Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6735e5af1d56d8f0ccc708ed468916ff2f1abe690286a1396380b93c7b3c7d28
Instruction ID: 1d7d01b4fc260fffae3e8b47d400d31a4c7c4d9d92cc62390c8c63a826e34bc9
Opcode Fuzzy Hash: 6735e5af1d56d8f0ccc708ed468916ff2f1abe690286a1396380b93c7b3c7d28
Instruction Fuzzy Hash: 36D1F336A1D751CFCB24CF78D88062AB7E2BB89314F094A6ED492C7391D334DA45CB91

Function 00AC7AB0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6471a31e01aca4d2d5fe1e547ca1d996c86b4e7afa2acb3778ff5a08480c25f2
Instruction ID: b686a4182a2a1a5b2830485ac9b9f0678c80708909dcd0401cf0019f4a28472b
Opcode Fuzzy Hash: 6471a31e01aca4d2d5fe1e547ca1d996c86b4e7afa2acb3778ff5a08480c25f2
Instruction Fuzzy Hash: FBB10472A0C3508BE724DB69CC41B6FB7E5AFC4314F0A492DE99997391EA35DC048F92

Function 00A8AF10 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction ID: 9609855b4d0a98b12c384a96336f4a694d73d02a19161eb5ef41f546eb46c486
Opcode Fuzzy Hash: 9c6117061885288c1b39a5b943f8482e52345fd8b1a48c2f17ef7dcb0cf10c7c
Instruction Fuzzy Hash: 0FC189B2A187418FC360DF28DC96BABB7E1FF85318F08492DD1D9C6242E778A155CB16

Function 00A96536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534ebf07acfe5e08aee461a3aa2fd79772317cc4133be239fb7a3575125354b9
Instruction ID: 451d6789a698d48212926f85d4b848bfe5646f86fc4d7c2f29f04bca2542800a
Opcode Fuzzy Hash: 534ebf07acfe5e08aee461a3aa2fd79772317cc4133be239fb7a3575125354b9
Instruction Fuzzy Hash: 9AB110B4600B408FD7258F24CA81B67BBF1EF4A704F14885DE8AA8BA52E735F805CB54

Function 00AC7710 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 680b7028737082b140a37a9e8c4ecc7adcfd530bd78857f0275f48b4f38f8616
Instruction ID: 223b43f324b3435249c5b41f29e6a746c4d7d3443a45590e68f8c720f736f462
Opcode Fuzzy Hash: 680b7028737082b140a37a9e8c4ecc7adcfd530bd78857f0275f48b4f38f8616
Instruction Fuzzy Hash: 2B918A71A08301ABEB20DB64C881FAFBBE5FB85350F55881CF98597351E730E940CB92

Function 00ACA0D0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584509b6c209880d79bd90c3b6a51cc405913e25dc7aa5ed530b2b755b76b0e0
Instruction ID: 23b0342ef68f184036c615e438cad4b4892eeedc5e02a4f1e0c6cc006b3bed52
Opcode Fuzzy Hash: 584509b6c209880d79bd90c3b6a51cc405913e25dc7aa5ed530b2b755b76b0e0
Instruction Fuzzy Hash: A1819C346097458FD724DF68C890F2AB7E5EF69748F16892CE4868B261E731EC11CB92

Function 00AB64F0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517d2a975b6395ec8a54b275cd4e648892b8c0030c7de7aaf873de0bb0e9b2d4
Instruction ID: ec24a6cb21eeb5287a2ee86946d3e373c7fbd79c205cc5f51c8f335887d2ec11
Opcode Fuzzy Hash: 517d2a975b6395ec8a54b275cd4e648892b8c0030c7de7aaf873de0bb0e9b2d4
Instruction Fuzzy Hash: A971E733B29A904BC3249D7C4C923E5AA975BE6334B3EC379E9B4CB3E6D52D48064350

Function 00AA28E9 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9399db929d2ec430bd9f31915ba9550a1b2279352a1ae0e6830f32a0782bae2
Instruction ID: 245613225c6c0ea9e551676e7df0bde9778d235cba59d15544ff65a40bd72014
Opcode Fuzzy Hash: a9399db929d2ec430bd9f31915ba9550a1b2279352a1ae0e6830f32a0782bae2
Instruction Fuzzy Hash: 6B6167B44083509BD310AF59E891B2BBBF1EFA6750F08491DF4C58B2A1E379D921CB66

Function 00AA7C00 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435c1a98f82f501209c13d19f06eee0a2414f4d56c4fa5094d4a0a198513c486
Instruction ID: 938f1e10db5442a91565f2792c2126616b50b666f460b83fb5c8194a141b2f4f
Opcode Fuzzy Hash: 435c1a98f82f501209c13d19f06eee0a2414f4d56c4fa5094d4a0a198513c486
Instruction Fuzzy Hash: 8E519EB1608204ABDB20AF64CC92B7B73B5EF86764F144958F9868B2D1F375DC05CB62

Function 00AB1860 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction ID: 988801a232243cc149ca98e07b205aac058e9a8a9b5836b39ceb2cf3b1e8b4d9
Opcode Fuzzy Hash: 6d108e008403b3c92b59985e25fae4eb0cb21936506a5ffd7efe5999b9cc5533
Instruction Fuzzy Hash: 7961D03160D341ABD714CF69C5A07AFBBEABBC5390FA4C92DE4898B352D270ED819741

Function 00AB82D0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902d568f6cff8716f5b738e335a1e85c3f20be56cb074a36d1d90bfe673f43e9
Instruction ID: 1e2a1e7297483b167aea72ddd261510a47e250ba28dcacf9ce047458bf3dbcbc
Opcode Fuzzy Hash: 902d568f6cff8716f5b738e335a1e85c3f20be56cb074a36d1d90bfe673f43e9
Instruction Fuzzy Hash: 2E612633A5AA914BC3248A3C5C553E66A9F5BD2730F3EC365D8B58B3E6C96D4802D341

Function 00A942FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975afe3188177693a53dae7cbf52a6aa5b53127994b9aea88f8fd02c06048d98
Instruction ID: 6fdf74c54e9a70d6fe5c0ea653173dd6ae2a7947869fbdf83f421ff4ea91e438
Opcode Fuzzy Hash: 975afe3188177693a53dae7cbf52a6aa5b53127994b9aea88f8fd02c06048d98
Instruction Fuzzy Hash: BD81E1B4810B00AFD360EF39DA47B57BEF4AB06201F504A1DE4EA97694E7306419CBE3

Function 00ABE8A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction ID: 9dbb9690e3b5e8079110cb7767e479d730dd72f0d18e4614a67218ff6dd2024a
Opcode Fuzzy Hash: 53adb1b22930f8a695f789fdc3f4b943ccd6ac5fb5c634955e3c1cdf4e3fec6a
Instruction Fuzzy Hash: 99518DB16083448FE314DF69D49439BBBE5BBC5318F044E2DE4E983351E379DA088B82

Function 00AC7520 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28b554cedb491b6fdc9d0120756e9691a871fa365f8a3b8b23a6e4166457deb
Instruction ID: 7efe75a496b192fb6c436a22bae5cc0ca84c27c39be3e457f3693897aecf0600
Opcode Fuzzy Hash: c28b554cedb491b6fdc9d0120756e9691a871fa365f8a3b8b23a6e4166457deb
Instruction Fuzzy Hash: 3751E23160D214ABC7159F18CC90F2EB7E6FB85354F2A8A2CE8E657391D631EC118B91

Function 00A85A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545c8cf8b5eaf3d0757681190385acc0d5c40ce3b28b3dcf089d25496fe5d375
Instruction ID: 93786997b5611e70600aaff3982801e6039754ebfb64ac2a74f9304c82484390
Opcode Fuzzy Hash: 545c8cf8b5eaf3d0757681190385acc0d5c40ce3b28b3dcf089d25496fe5d375
Instruction Fuzzy Hash: CA51D2B5E047049FC714EF24D884926B7A1FF89364F15466CFC9A9B352D631EC42CB92

Function 00B55CF0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2adb74bb3619a6eaa59969a4096c1f66477d13c4f196b50b440fed2c4da48e3
Instruction ID: 0d1ec5161a9405236d7cf46e043d7f11eaf91f9316f56f51b67a6f2700198191
Opcode Fuzzy Hash: a2adb74bb3619a6eaa59969a4096c1f66477d13c4f196b50b440fed2c4da48e3
Instruction Fuzzy Hash: B051A0B36086009FE349AE2ADC857BEBBE6EFD4320F16892DD6C1C7744DA3494018656

Function 00AAEC48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf510286f4686f0202b1b410ccaaf78bf85093924531177f5735d6eadd4a305
Instruction ID: 97629b0ced7341e3902c3edfa18f4f8c4daa9d4b2ed9efeac64312dd40f3dc9b
Opcode Fuzzy Hash: 2cf510286f4686f0202b1b410ccaaf78bf85093924531177f5735d6eadd4a305
Instruction Fuzzy Hash: 24419D78900315DBDF20CF94DC91BAAB7B0FF0A350F144549E945AB3A1EB38A951CBA1

Function 00B3B15C Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a620a9aa08b64689398102207a5700b5c29d81b7179b528d5ec87d6e94e43c
Instruction ID: 6b22fde48a10573cbe8ff6155b720e3e655c7ff35a6125a5362e3e65b9e54612
Opcode Fuzzy Hash: 37a620a9aa08b64689398102207a5700b5c29d81b7179b528d5ec87d6e94e43c
Instruction Fuzzy Hash: 144107F3E08110AFE3046A29EC55B6BB7E5EF90710F19453DEAC9C7780E9759C10C696

Function 00AC9B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55cfe57e06e3430f279a4ef95c4343b07ce96f86a8435be2e17876ddb58a871b
Instruction ID: e56d3d2e36735eba92d5ac6dac07cf927b200e5ae840bb882f50794e2fa9e0cd
Opcode Fuzzy Hash: 55cfe57e06e3430f279a4ef95c4343b07ce96f86a8435be2e17876ddb58a871b
Instruction Fuzzy Hash: 11419B3460C300AFD710DB65D994F2BBBE6EB85714F26882CF58A9B251D331EC01CBA2

Function 00A92030 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a053c7c032b73cbd9cf2e48231e99f12a293b0ec25e6fcd31c89aaa2254ad80
Instruction ID: 136d617c0c953e3e607191c819a6d6f88379aae07d127e7a10c61a89911bf44b
Opcode Fuzzy Hash: 2a053c7c032b73cbd9cf2e48231e99f12a293b0ec25e6fcd31c89aaa2254ad80
Instruction Fuzzy Hash: CF411632B083215FD75CCF2A849473ABBE2ABC5310F09822EE4DA8B3D4DA748D45D781

Function 00A91E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d87e775b0e8c02496acbfdd4f2073bdb93b08af5eee2165b2988fd102940859
Instruction ID: 1ac50cac3db858523f8c0ed547125a33d4a8d626888a7da4f418caaf1f8ba406
Opcode Fuzzy Hash: 0d87e775b0e8c02496acbfdd4f2073bdb93b08af5eee2165b2988fd102940859
Instruction Fuzzy Hash: 4C41F074608380ABD720AB59C884B2EFBF5FB8A744F144D1DF6C497292C376E8148F66

Function 00AC8D8A Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7c00008fc354ce98d09b6e814dc5cc32e9a4a1c365622ef32f9257a58a09a3
Instruction ID: 615119c5a6af6bce5a3b79fd4ba5ccbaf3f6d2187e36625d7284aeb563ead259
Opcode Fuzzy Hash: fd7c00008fc354ce98d09b6e814dc5cc32e9a4a1c365622ef32f9257a58a09a3
Instruction Fuzzy Hash: E441E53160C3548FC705DF68C490A2EFBE6AF99300F0A8A1DD4D6DB291CB78DD018B82

Function 00A9D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af13fb9592c2e8fabe291fec264748894c169914e4f95d4ced03dac121f6df0d
Instruction ID: 90448ff8a1bb986b341434bae998d59f5a4517d96dbfd99788965084c915e82c
Opcode Fuzzy Hash: af13fb9592c2e8fabe291fec264748894c169914e4f95d4ced03dac121f6df0d
Instruction Fuzzy Hash: 3641A9B16093818BD7309F14C881FABB7B0FFA63A4F040959E48A8BA91E7744981CB57

Function 00ABF030 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction ID: d636999267563b5f2e37a44499967c2de48c38f4bb364b842690b13112557a4c
Opcode Fuzzy Hash: c5be6113664422e96713363ec41851647c31506b086c17a8b3ff98e201e465e1
Instruction Fuzzy Hash: 54210A329081144BC324EB5DC88167BF7E8EB99704F0A863ED9C4A7296E3359C1487D1

Function 00AC67EF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109af1dd1e56277180bf3edc70fb2187ee53e73dffb19b78d0b0aa7bab87dc87
Instruction ID: 358853ae458ba78baa6b51c91067a1ab7075483903ae92f8a38184763737b4bc
Opcode Fuzzy Hash: 109af1dd1e56277180bf3edc70fb2187ee53e73dffb19b78d0b0aa7bab87dc87
Instruction Fuzzy Hash: A731437051C3829AE714CF14C4A0A2FBBF0EF96788F54580DF4C8AB261D338D985CB9A

Function 00AA5E70 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3af81033b03dcb85599cea8ea9442e1c5b0a87f7ee75ce6b0b7cb0d55aa6074
Instruction ID: 59e7c3afb8119096510d92f2c9948b27a03a6adfac7a1473fae0f84070cad65a
Opcode Fuzzy Hash: a3af81033b03dcb85599cea8ea9442e1c5b0a87f7ee75ce6b0b7cb0d55aa6074
Instruction Fuzzy Hash: A2219CB0909201DBC320AF28C95192FB7F4EF92764F44891CF4D99B292E335CA00CBA7

Function 00CE918D Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04094f9466c31175b83e02e9022846a4407211f444e3c408a3a04313301a1a0d
Instruction ID: a351e874f9ad4822574f93374111b283100416d343e3b003ca581dd577af0c6a
Opcode Fuzzy Hash: 04094f9466c31175b83e02e9022846a4407211f444e3c408a3a04313301a1a0d
Instruction Fuzzy Hash: C93144B220C7049FE345BF2AD88567EFBE6FF98310F06892CD6D487650EA3054848B97

Function 00A849A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction ID: e0c32e6c3ec7c8da2f697f9da86ee3c44d3064fc78ab31f715cc0d79fa727ca0
Opcode Fuzzy Hash: cbe2eee255ce80e2df90ed4850d7395439c2c852be5922ee4a7cea5853ec6c97
Instruction Fuzzy Hash: 5631CA31648212DFD714AF58D880A2BF7E1EF8C359F18892DE89A9B241D331DC52CB46

Function 00AC64B8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc925efec310739ff66e833dd82aa56a0810f053073a55c7d67b8240a1b0b760
Instruction ID: c44e1e77596dc41307882d80266096072ac62693d7cb03e9a828346882644f3a
Opcode Fuzzy Hash: dc925efec310739ff66e833dd82aa56a0810f053073a55c7d67b8240a1b0b760
Instruction Fuzzy Hash: 26216674A0C2409BC708EF59D690E2EFBF2FB85741F29881CE4C597361C334A851CB62

Function 00A90EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27543a36afcf0f65d5655e8f713718937db6acf37724dc939d8c0e42890302b
Instruction ID: 4310b986f5233fe19c031054749e500e15f4c3bfdd31094c7278abc9bc4d7256
Opcode Fuzzy Hash: d27543a36afcf0f65d5655e8f713718937db6acf37724dc939d8c0e42890302b
Instruction Fuzzy Hash: 6121F8B5A0121A9FDF15CF94CC90FBEBBB2FB4A304F144859E911BB292C735A911CB64

Function 00ABB650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: ada8b6001073bc98b9eff02651fee6ad9a33853a5460ab059bfeae56c0e73642
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 5D11E533A151D80EC3168E3C84505A5BFA71AA3234B598399F4F89B2D3D772CD8A9374

Function 00AB0B80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction ID: 7a7db72ae9a90b7b321c71eb6115066f8522e24f10a5c61dea4c4a51169ea134
Opcode Fuzzy Hash: 90022ddfb32469098a8610d4b68e70bc315f5b0e8987f5b71d64abe4c0da561b
Instruction Fuzzy Hash: 9D0171F5A0030247EB20AF54A5D1F7BF2ADAF81B68F18452CE84657203EB76EC05C7A1

Function 00AAD1E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2651a56405d6a3dc6ff3f768cd06b4c2c8610a82ad199a76ad5234a310a402
Instruction ID: dd26c6420cedf3cba5fc0ea990aab1bfd40e72ef27e1d6d02d95dcc67d3f1488
Opcode Fuzzy Hash: fe2651a56405d6a3dc6ff3f768cd06b4c2c8610a82ad199a76ad5234a310a402
Instruction Fuzzy Hash: D011DBB0408380AFD3109F618594A6FFBE5EBA6B14F148C0DE6A59B251C379E819CB56

Function 00A86EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f95d5cd951cd931a48693845bdc26b0d82cf8b00f18a023a2436e562afa9e9
Instruction ID: 814a3dcf23e64313341109d4fa289d98e170ef8804aabac38ad30e234e6afdef
Opcode Fuzzy Hash: 71f95d5cd951cd931a48693845bdc26b0d82cf8b00f18a023a2436e562afa9e9
Instruction Fuzzy Hash: E9F0BB3AB292190B7610DEABE884837B396D7D9355F155538EA41D3201DE72EC065291

Function 00ABB8C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction ID: 6506d07c58c905065930edc77b6421f51c28c54387ea28b09faa2761b04cb969
Opcode Fuzzy Hash: dad40b8a8b0cf0c680be38028a9801f4e1e9da1297b4f3b9e1d9df466e9bee7e
Instruction Fuzzy Hash: 1E0162B3A199610B8348CE3DDC1156BBAD15BD5770F19872DBEF5CB3E0D230C8118695

Function 00A9C5F0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction ID: afd6f86e1ed7dc578beff9a6215ab27dc393fb41cabbec3b70aacfa27007612f
Opcode Fuzzy Hash: d8ebd7708255391ffa87ed53dd5dbf97c7cff7b52fcdad9dabb06971c835301f
Instruction Fuzzy Hash: EB014B72A196204B8308CE3C9C1112ABEE19B86330F158B2EBCFAD73E0D664CD548696

Function 00A9B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: aec13305b204b2dd632094b1c1115a8f07e2167000aae0e89e1542a8bc0c9b22
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: BFF0A7B571451067DF22CA95AC80B37BBDCCBC6354F190426E84557143D2A15845C3F5

Function 00AB8220 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648134df7972bde04b0c7b8bb812e259ce1c31cee60ba3a79c0a526c7b1285d7
Instruction ID: a30363824df953d3d5ad283f1632ab10bc09d458a61306d66d27eac05a55c5e6
Opcode Fuzzy Hash: 648134df7972bde04b0c7b8bb812e259ce1c31cee60ba3a79c0a526c7b1285d7
Instruction Fuzzy Hash: A201E4B44147009FC360EF29C445B47BBE8EB08714F014A1DE8AECB680D770A5448B82

Function 00AC1440 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 9fa767a59ac4c45a58aa288cfef3cba26ce62ad9df94d4dd96c989226a52ba45
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 32D0A775708321469F788F19A500E77F7F0EAC7B12F8A955EF586E3149D230DC41C2A9

Function 00A91ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2abb1f1403370f387039847095f276a8b5b9ab9c5a8c9bc1a1fbf4b5fdf5bf
Instruction ID: c73a04278097398b0e1e3df130dfc684c1f59224f659c2b4ba334ca2c4f0f8c1
Opcode Fuzzy Hash: 2d2abb1f1403370f387039847095f276a8b5b9ab9c5a8c9bc1a1fbf4b5fdf5bf
Instruction Fuzzy Hash: 14C08C34A6A0018FC208CF84FD95832BBF9A30B308740703ADA03F3721CA30C8078909

Function 00AC6094 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 626bc2376eb3fa9847d5ce22cf9c1da99c50692717a559c694944328dbf6f53c
Instruction ID: 7fcff9a93e89ab3f226e21318a00ab314e0a1ea24a2e9dafa064a01264c6b4ee
Opcode Fuzzy Hash: 626bc2376eb3fa9847d5ce22cf9c1da99c50692717a559c694944328dbf6f53c
Instruction Fuzzy Hash: F8C09B35A5D00497970CCF54D951975F3769B9771C724B01FD80723255C134D913D95D

Function 00A91A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c109670c8e606d75eb4cdfd79f56af09793ef918bd3a0a3be24187754fb00d3
Instruction ID: db242654e4332b7e92c62db770e9302e814406f501b7e1e0499726bb191562d1
Opcode Fuzzy Hash: 7c109670c8e606d75eb4cdfd79f56af09793ef918bd3a0a3be24187754fb00d3
Instruction Fuzzy Hash: 0FC09B34BA9041CFC64CCFCAE9D1831A7FD5307208711303A9B03F7761C560D4068509

Function 00AC5FD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2230232687.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000001.00000002.2230215406.0000000000A80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000AE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000C6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230266283.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230678914.0000000000D8C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230794173.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2230811558.0000000000F2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f7266f18cc69ca89708af9e56575f1404e39f7343eadc6ae3034bacea620ae
Instruction ID: 6e9bffbbe3f7eb4d33850ba03694c70eaf63fc7497810f7904202e50ae69f7aa
Opcode Fuzzy Hash: 98f7266f18cc69ca89708af9e56575f1404e39f7343eadc6ae3034bacea620ae
Instruction Fuzzy Hash: B7C09225B6A000ABAB4CCF58DD51935F3BA9B8BA1CB14B02FC807A3256D134D913860D

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
file.exe

Function 00AC50FA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63
libraryCOMMON

Function 00A8FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Function 00A8D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Function 00AC5700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Function 00AC5BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00AC695B Relevance: 1.4, Strings: 1, Instructions: 100
COMMON

Function 00A9049B Relevance: .3, Instructions: 264
COMMON

Function 00AC3220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Function 00AC3202 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON